docs(monitoring): Docker Desktop local-run notes (host-metrics profile)

- node-exporter + cadvisor need Linux rootfs mounts (fail on Docker
  Desktop) — moved to 'host-metrics' profile; VPS command updated
- loki 3.5: ingestion_burstsize_mb → ingestion_burst_size_mb
- prometheus joins erp_shared so job 'erp-api' resolves (verified: up=1)

.env.example

@@ -0,0 +1,71 @@
+# ============================================================
+# ERP stack configuration — copy to .env and fill in real values.
+# .env is git-ignored; NEVER commit real credentials.
+#   Local dev:      cp .env.example .env   (defaults work as-is)
+#   Production VPS: /srv/erp/.env with STRONG values for every entry —
+#                   docker-compose.prod.yml refuses to boot without them.
+# ============================================================
+
+# --- Public hosts (production; local defaults live in docker-compose.yml) ---
+APP_HOST=aramesh.bennu-api-bahrestan.ir
+API_HOST=api.bennu-api-bahrestan.ir
+AUTH_HOST=casdoor.bennu-api-bahrestan.ir
+S3_HOST=s3.bennu-api-bahrestan.ir
+STORAGE_HOST=storage.bennu-api-bahrestan.ir
+
+# --- Traefik / Let's Encrypt ---
+TRAEFIK_ACME_EMAIL=you@example.com
+
+# --- Environment: "prod" enables the fail-fast startup checks in the API ---
+ENVIRONMENT=prod
+
+# --- PostgreSQL (app + Casdoor share the instance) ---
+POSTGRES_PASSWORD=CHANGE_ME_strong_db_password
+
+# --- MinIO object storage root credentials ---
+MINIO_ROOT_USER=CHANGE_ME_minio_user
+MINIO_ROOT_PASSWORD=CHANGE_ME_long_random_minio_password
+
+# --- Casdoor OIDC application (must match the Casdoor application record) ---
+CASDOOR_CLIENT_SECRET=CHANGE_ME_casdoor_client_secret
+CASDOOR_ADMIN_PASSWORD=CHANGE_ME_casdoor_console_admin_password
+
+# --- CORS: exact browser origins allowed to call the API (comma-separated) ---
+CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
+
+# --- Developer Mode (X-User-* header identity + login panel) ---
+# MUST stay false in production. Only for local debugging without tokens.
+DEV_LOGIN_ENABLED=false
+
+# --- Deploy webhook (Gitea push → rebuild; see infra/deploy-webhook/) ---
+GITEA_WEBHOOK_SECRET=CHANGE_ME_long_random_webhook_secret
+
+# --- Backups (db-backup sidecar; see docker-compose.yml) ---
+BACKUP_DIR=/srv/erp/backups
+BACKUP_INTERVAL_SECONDS=86400
+BACKUP_KEEP_DAYS=14
+
+# --- Monitoring stack (see monitoring/README.md) ---
+# API log format for Loki ingestion ("text" locally, "json" in production)
+LOG_FORMAT=json
+# GlitchTip (error tracking). GLITCHTIP_HOST must be a public DNS name —
+# the browser SDK posts errors there.
+GLITCHTIP_SECRET_KEY=CHANGE_ME_random_django_secret
+GLITCHTIP_DOMAIN=https://errors.bennu-api-bahrestan.ir
+GLITCHTIP_HOST=errors.bennu-api-bahrestan.ir
+GLITCHTIP_DB_PASSWORD=CHANGE_ME_glitchtip_db_password
+GLITCHTIP_FROM_EMAIL=noreply@bennu-api-bahrestan.ir
+GLITCHTIP_EMAIL_URL=consolemail://
+# Grafana (dashboards) — UI is loopback-only (:3001) unless you add Traefik labels
+GRAFANA_ADMIN_PASSWORD=CHANGE_ME_grafana_password
+GRAFANA_ROOT_URL=http://localhost:3001/
+# OpenPanel (product analytics) — client id/secret from the OpenPanel project
+OPENPANEL_API_URL=http://openpanel-api:3333
+OPENPANEL_CLIENT_ID=
+OPENPANEL_CLIENT_SECRET=
+# Public origin of the OpenPanel dashboard/API the BROWSER talks to
+# (e.g. https://stats.bennu-api-bahrestan.ir — see monitoring/README.md)
+OPENPANEL_PUBLIC_URL=
+# Sentry/GlitchTip DSNs created in the GlitchTip UI after first boot
+SENTRY_DSN_BACKEND=
+SENTRY_DSN_FRONTEND=

.gitignore

@@ -11,14 +11,27 @@ __pycache__/
 venv/
 
 # ---- Env / secrets ----
+# All credentials live in git-ignored .env files (server-side and local).
+# NEVER commit .env or database dumps — see docs/SECRET-MANAGEMENT.md.
+.env
+.env.*
+!*.env.example
+backend/.env
 frontend/.env
 *.local
 
+# ---- Database dumps (contain user rows + signing material) ----
+*.dump
+*.sql.gz
+
 # ---- Local session / backups ----
 .zcode/
 v1.2 - Copy/
 inv dash/
 
+# ---- Machine-local compose overrides (LAN phone access, etc.) ----
+docker-compose.override.yml
+
 # ---- Screenshots (root) ----
 *.png
 *.jpg

README.md

@@ -81,7 +81,7 @@ v1.3/
 ## 🔐 Login
 
 The whole system is behind a login page (`/login`). Login is **in-page**:
-the form (username / password / optional organization) is sent to
+the form (username / password) is sent to
 `POST /api/v1/auth/login`; the backend exchanges it with Casdoor
 (password grant), verifies the returned JWT, and starts the session —
 no browser redirect to Casdoor.
@@ -105,14 +105,78 @@ for production builds).
 | What | Where | Credentials |
 |---|---|---|
 | App | http://localhost (via Traefik) | — |
-| Casdoor console | http://localhost:8080 | `admin` / `123` |
-| Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password `123456` |
+| Casdoor console | http://localhost:8080 | admin credentials are set when you run the seeder (`CASDOOR_ADMIN_PW`) — never commit them |
+| Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password from `CASDOOR_SEED_PASSWORD` (bcrypt-hashed at rest — see `backend/tools/seed_casdoor.py`) |
 
 Run `backend/tools/seed_casdoor.py` once after the first boot to create the
 Casdoor organization, application and users (idempotent). Full details —
 addresses, credentials, role model, failure scenarios and the checklist —
 are in [`docs/casdoor-auth.md`](docs/casdoor-auth.md).
 
+> The **currently committed seed** (`backups/علی محقق/`) instead ships a
+> single admin — `ali.mohaghegh` («علی محقق») — see
+> [Restoring the committed seed data](#restoring-the-committed-seed-data).
+
+---
+
+## 🌐 Working with the deployed system (server)
+
+The production deployment of this stack runs on the server and is reachable
+at these public addresses (HTTPS):
+
+| What | Address |
+|---|---|
+| **App (ERP)** | https://aramesh.bennu-api-bahrestan.ir/ |
+| **Casdoor admin panel** | https://casdoor.bennu-api-bahrestan.ir/ |
+
+Log in to the app with your Casdoor account (org `inventory`); the role is
+assigned inside the app (`users.role` — see «Login» above and
+[`docs/casdoor-auth.md`](docs/casdoor-auth.md)).
+
+### MinIO console on the server (SSH tunnel)
+
+The MinIO console is deliberately **loopback-only** on the server
+(`127.0.0.1:9001`) — verified unreachable from the internet — so the way in
+is an SSH tunnel from your machine:
+
+1. Open PowerShell and start the tunnel (**keep the window open** while you
+   use the panel):
+
+   ```powershell
+   ssh -L 9001:127.0.0.1:9001 <user>@<server-host>
+   ```
+
+   You will also land in a normal SSH session — that is fine; the tunnel
+   lives as long as the window stays open.
+
+2. In your browser, open: **http://localhost:9001**
+
+3. Log in with the production MinIO root credentials from the server's
+   `/srv/erp/.env` (`MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD`) — they are
+   **never** written in this repo or its history. See
+   [`docs/SECRET-MANAGEMENT.md`](docs/SECRET-MANAGEMENT.md).
+
+You will see the **`procurement-files`** bucket — the invoices/proformas the
+ERP stores, browsable and downloadable from there.
+
+⚠️ Those credentials are **full admin access to the file storage**. They live
+only in the server-side `.env`; if one ever leaks, rotate it immediately
+(checklist in `docs/SECRET-MANAGEMENT.md`).
+
+Close the PowerShell window (or `Ctrl+C`) when you are done to drop the
+tunnel.
+
+Notes from the server setup:
+
+- The panel is published only on the server's loopback, so the internet
+  cannot reach it at all — the tunnel is what carries it to your browser.
+- Host port `9000` stays reserved for the deploy-webhook receiver, which is
+  why the console uses `9001`.
+- If you ever need the raw S3 API from your machine, or a clickable URL for
+  the console (e.g. `storage.aramesh.bennu-api-bahrestan.ir` behind Traefik
+  with a password prompt on top), that can be arranged on request — the
+  tunnel remains the safer default.
+
 ---
 
 ## Prerequisites (target machine)
@@ -150,15 +214,23 @@ All should show `Up` (postgres also `(healthy)`).
 | Frontend UI | http://localhost |
 | API docs (Swagger) | http://localhost:8000/docs |
 | API health | http://localhost:8000/health → `{"status":"ok","service":"procurement-api"}` |
+| API readiness (DB + MinIO + Casdoor) | http://localhost:8000/health/ready |
+| Metrics | http://localhost:8000/metrics |
 | MinIO console | http://localhost:9001 (user/pass `minioadmin`/`minioadmin`) |
 | Database | `localhost:5433`, db `procurement`, user/pass `postgres`/`postgres` (Casdoor uses the same instance, db `casdoor`) |
 
-Quick end-to-end check (Traefik → frontend proxy → API → DB):
+Automated end-to-end checks (authenticates via `SMOKE_USER` /
+`SMOKE_PASSWORD` — the seeder users):
 
 ```powershell
-curl http://localhost/api/v1/quotes?expand=supplier,project,line_items,termsheets,events,decision,receipt
+backend\tools\smoke_test.py   # read paths
+backend\tools\smoke_test_write.py / smoke_test_misc.py
 ```
 
+> Every API route now requires a Casdoor JWT — a bare
+> `curl http://localhost/api/v1/quotes` returns **401** by design.
+> Day-2 operations (deploys, backups, monitoring): [`docs/OPERATIONS.md`](docs/OPERATIONS.md).
+
 ---
 
 ## MinIO (object storage for invoice / proforma files)
@@ -197,38 +269,33 @@ docker exec -it procurement-postgres psql -U postgres -d procurement
 
 ---
 
-## Restoring the demo data (for the team)
+## Recovery / seeding
 
-The databases are **not** in git — Docker volumes hold the data. To let
-everyone see the same system state, the repo ships exact database dumps in
-`backups/`. After a fresh boot:
+The databases are **not** in git — Docker volumes hold the data, and
+database dumps must never be committed (they contain user rows and signing
+material). Two supported ways to bring a fresh stack up:
 
-```powershell
-powershell -ExecutionPolicy Bypass -File .\backups\restore.ps1     # Windows
-bash backups/restore.sh                                            # Linux / Git Bash
-```
+1. **Empty boot** — schema v2.6 auto-applies on the first boot of an empty
+   `postgres_data` volume; then run the seeders:
 
-This **replaces all data** in the `procurement` and `casdoor` databases with
-the committed state — a clean, realistic demo: 3 projects × 2 warehouses,
-4 suppliers, 12 materials across all 8 categories, and 4 quotes covering
-every lifecycle state (offered / in-transit / partially received /
-completed) with matching stock.
-
-Two alternative ways to get a clean state:
-
-1. **App seeder** (realistic demo data, keeps the Casdoor org as-is):
    ```powershell
+   # Casdoor org + app + users (prints/generates credentials — do not commit them)
+   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
+   # Demo dataset (optional):
    docker exec procurement-api sh -c "cd /srv/backend && python -m tools.seed"
    ```
-2. **Casdoor seeder** (creates org `inventory` + app + users razaei /
-   mousavi / mohaghegh / tester — run once after a fresh volume):
+
+2. **Restore your own dump** — create dumps on the server (kept server-side,
+   e.g. `/srv/erp/backups/`), never in git:
+
    ```powershell
-   python backend/tools/seed_casdoor.py   # from the host, or from the api container
+   docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc > /srv/erp/backups/procurement-$(date +%F).dump
+   docker exec procurement-postgres pg_dump -U postgres -d casdoor    -Fc > /srv/erp/backups/casdoor-$(date +%F).dump
    ```
 
-To create a fresh dump of your own current state: stop `api` + `casdoor`,
-`docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc`
-(+ the `casdoor` DB) into `backups/`, then start them again.
+   Restore with `pg_restore --clean --if-exists` (stop `api` + `casdoor`
+   first — this **replaces all data**). The scheduled backup sidecar
+   (see `docs/OPERATIONS.md`) automates this.
 
 ## Common operations
 
@@ -243,10 +310,11 @@ docker compose down -v              # ⚠️ full reset — wipes DB + MinIO vol
 
 ## Known behavior
 
-- Authentication is Casdoor-based (JWT verified via JWKS): `/auth`, `/users`,
-  `/inventory` and `/pm` are protected (401 without a token, 403 without a role).
-  The procurement CRUD endpoints (quotes, suppliers, materials, …) are still
-  open — dev placeholder, do not expose to the public internet.
+- Authentication is Casdoor-based (JWT verified via JWKS) and **required on
+  every API route** except `/health`, `/health/ready` and `/auth/login`
+  (401 without a token, 403 without a role). The former dev-header fallback
+  (`X-User-Role` / `X-User-Name-B64`) is disabled unless
+  `PROCUREMENT_DEV_LOGIN_ENABLED=true` — never enable it in production.
 - Roles live in the app's `users` table (Casdoor is identity-only): `pm`,
   `procurement_manager`, `admin`. Role changes are **admin-only** (RBAC);
   the procurement manager can only assign projects to project managers.

backend/app/auth.py

@@ -26,7 +26,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
-from app.db.engine import get_db
+from app.db.engine import AsyncSessionLocal
 from app.models.procurement import Project, User
 from app.utils.errors import (
     ForbiddenError,
@@ -103,15 +103,17 @@ async def _verify_token(token: str) -> dict:
 class UserContext:
     user: User
     role: str | None
-    project_id: object | None  # uuid.UUID | None
+    project_id: object | None  # uuid.UUID | None — default (first) project of a PM
+    project_ids: list  # every project this PM manages (1:N — empty for non-PMs)
     display_name: str
 
 
 async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
-    """Auto-provision the `users` row from token claims; resolve role + PM project.
+    """Auto-provision the `users` row from token claims; resolve role + PM projects.
 
     First login: creates the row with role NULL (an admin assigns it later).
-    PMs: resolves their single project via projects.pm_user_id.
+    PMs: resolves EVERY project they manage (projects.pm_user_id = user);
+    `project_id` stays the first one (oldest) for backward compatibility.
     """
     casdoor_id = str(claims.get("sub") or claims.get("id") or "")
     if not casdoor_id:
@@ -134,20 +136,50 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
         db.add(user)
         await db.flush()
 
-    project_id = None
+    project_ids: list = []
     if user.role == "pm":
-        project = await db.scalar(select(Project).where(Project.pm_user_id == user.id))
-        project_id = project.id if project else None
+        projects = (
+            await db.execute(
+                select(Project)
+                .where(Project.pm_user_id == user.id)
+                .order_by(Project.created_at, Project.id)
+            )
+        ).scalars().all()
+        project_ids = [p.id for p in projects]
+    project_id = project_ids[0] if project_ids else None
 
     display_name = f"{user.first_name} {user.last_name}".strip() or user.casdoor_id
-    return UserContext(user=user, role=user.role, project_id=project_id, display_name=display_name)
+    return UserContext(
+        user=user,
+        role=user.role,
+        project_id=project_id,
+        project_ids=project_ids,
+        display_name=display_name,
+    )
 
 
-async def get_optional_user(request: Request, db: AsyncSession) -> UserContext | None:
+async def pm_project_ids(db: AsyncSession, user: User) -> list:
+    """Every project id managed by the given PM user (oldest first)."""
+    rows = (
+        await db.execute(
+            select(Project.id)
+            .where(Project.pm_user_id == user.id)
+            .order_by(Project.created_at, Project.id)
+        )
+    ).scalars().all()
+    return list(rows)
+
+
+async def get_optional_user(request: Request, db: AsyncSession | None = None) -> UserContext | None:
     """Resolve the caller from the Casdoor Bearer token, or None when absent.
 
     Raises UnauthorizedError for a present-but-invalid token; callers decide
     their own fallback only for the no-token case (e.g. dev headers).
+
+    IMPORTANT: when ``db`` is omitted (pure auth-dependency usage), a
+    short-lived session of its own is used — querying the REQUEST session
+    here would auto-begin its transaction and break endpoints that open
+    explicit ``async with db.begin()`` blocks afterwards.
     """
     auth = request.headers.get("authorization", "")
     if not auth.lower().startswith("bearer "):
@@ -155,13 +187,22 @@ async def get_optional_user(request: Request, db: AsyncSession) -> UserContext |
     token = auth.split(" ", 1)[1].strip()
     if not token:
         return None
+    if db is None:
+        async with AsyncSessionLocal() as own_session:
+            claims = await _verify_token(token)
+            return await context_from_claims(claims, own_session)
     claims = await _verify_token(token)
     return await context_from_claims(claims, db)
 
 
-async def get_current_user(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext:
-    """Require a valid Casdoor token (401 missing/invalid; 403 unprovisioned)."""
-    ctx = await get_optional_user(request, db)
+async def get_current_user(request: Request) -> UserContext:
+    """Require a valid Casdoor token (401 missing/invalid; 403 unprovisioned).
+
+    Resolves the user in its own session (see get_optional_user) so the
+    global auth dependency never interferes with an endpoint's explicit
+    transaction handling.
+    """
+    ctx = await get_optional_user(request)
     if ctx is None:
         raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     if ctx.role is None:

backend/app/config.py

@@ -1,7 +1,14 @@
 """Application configuration.
 
 All settings can be overridden with environment variables prefixed with
-``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env`` file.
+``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env``
+file. The docker-compose files inject them from the git-ignored ``.env`` —
+real credentials never live in this repository.
+
+``ENVIRONMENT`` is the safety switch: when it is ``"prod"``, the API runs
+fail-fast startup checks (see app.main._verify_production_settings) that
+refuse to boot with wildcard CORS, default credentials or dev login
+enabled.
 """
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -14,7 +21,10 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
-    # PostgreSQL DSN — the schema (migration.sql + seed.sql) must already exist.
+    # "dev" (local defaults allowed) | "prod" (fail-fast checks on startup).
+    ENVIRONMENT: str = "dev"
+
+    # PostgreSQL DSN — the schema (migration.sql) must already exist.
     DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/procurement"
 
     # Echo SQL statements to the console (dev aid).
@@ -22,6 +32,8 @@ class Settings(BaseSettings):
 
     # MinIO object storage — invoice / proforma attachments (S3-compatible).
     # Endpoint is the compose service name (`minio:9000`) inside Docker.
+    # Defaults are LOCAL DEV ONLY — production values come from .env and the
+    # prod startup checks reject them.
     MINIO_ENDPOINT: str = "localhost:9000"
     MINIO_ACCESS_KEY: str = "minioadmin"
     MINIO_SECRET_KEY: str = "minioadmin"
@@ -36,27 +48,54 @@ class Settings(BaseSettings):
     DEFAULT_PAGE_SIZE: int = 20
     MAX_PAGE_SIZE: int = 100
 
-    # CORS (dev-friendly default; the frontend is a static site).
-    CORS_ORIGINS: list[str] = ["*"]
+    # CORS — comma-separated exact browser origins (NOT "*" with
+    # credentials; the prod checks reject wildcard). Example:
+    # PROCUREMENT_CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
+    CORS_ORIGINS: str = "http://localhost,http://localhost:3000,http://localhost:5173"
+
+    # Developer Mode: in-page dev login panel (frontend build arg) AND the
+    # X-User-Role / X-User-Name-B64 header identity fallback in the
+    # inventory/pm routers. MUST stay false in production.
+    DEV_LOGIN_ENABLED: bool = False
 
     # Casdoor (OIDC) — JWT verification against the issuer's JWKS.
     CASDOOR_ENDPOINT: str = "http://localhost:8080"
     CASDOOR_ISSUER: str = ""  # expected token iss claim (default: CASDOOR_ENDPOINT)
     CASDOOR_CLIENT_ID: str = "inventory-app-client"
-    CASDOOR_CLIENT_SECRET: str = "inventory-app-secret-2026"
+    CASDOOR_CLIENT_SECRET: str = ""  # no default secret — set via env/.env
     CASDOOR_ORGANIZATION: str = "inventory"
     CASDOOR_APP_NAME: str = "inventory-app"
     CASDOOR_JWKS_URL: str = ""  # default: {endpoint}/api/public_jwks
     CASDOOR_AUDIENCE: str = "inventory-app-client"  # expected token aud (falls back to client_id)
 
     # Casdoor console admin — used by POST /users/sync to mirror Casdoor
-    # identities into the app's users table (dev defaults: admin / 123).
+    # identities into the app's users table. No default password.
     CASDOOR_ADMIN_USER: str = "admin"
-    CASDOOR_ADMIN_PASSWORD: str = "123"
+    CASDOOR_ADMIN_PASSWORD: str = ""
 
-    # Inventory dev fallback (only when no Authorization header is sent).
+    # Inventory dev fallback defaults (only used when DEV_LOGIN_ENABLED).
     INVENTORY_DEFAULT_ROLE: str = "pm"
     INVENTORY_DEFAULT_PROJECT_ID: str = ""
 
+    # ---- Observability (Phase 2) -------------------------------------------
+    # "text" (human console) | "json" (JSON lines for Loki/Promtail).
+    LOG_FORMAT: str = "text"
+    # Sentry/GlitchTip DSN — backend exception capture (empty = disabled).
+    SENTRY_DSN: str = ""
+    SENTRY_TRACES_SAMPLE_RATE: float = 0.0
+    # OpenPanel server-side event ingestion (empty = disabled).
+    OPENPANEL_API_URL: str = ""      # e.g. http://openpanel-api:8080 (self-hosted)
+    OPENPANEL_CLIENT_ID: str = ""
+    OPENPANEL_CLIENT_SECRET: str = ""
+
+    @property
+    def cors_origin_list(self) -> list[str]:
+        """Comma-separated CORS_ORIGINS → list for CORSMiddleware."""
+        return [o.strip() for o in self.CORS_ORIGINS.split(",") if o.strip()]
+
+    @property
+    def is_prod(self) -> bool:
+        return self.ENVIRONMENT.lower() == "prod"
+
 
 settings = Settings()

backend/app/db/init_db.py

@@ -302,6 +302,11 @@ _V26_DDL = [
     """
     CREATE INDEX IF NOT EXISTS idx_suppliers_category_id ON suppliers(category_id)
     """,
+    # PM → projects is 1:N (a PM may manage several projects). No UNIQUE on
+    # pm_user_id — just a lookup index for "projects of this PM" queries.
+    """
+    CREATE INDEX IF NOT EXISTS idx_projects_pm_user_id ON projects(pm_user_id)
+    """,
     # supplier_materials (v2.5) + its triggers (functions are CREATE OR REPLACE below).
     """
     CREATE TABLE IF NOT EXISTS supplier_materials (
@@ -387,3 +392,27 @@ async def ensure_v26(engine: AsyncEngine) -> None:
             AFTER INSERT OR UPDATE OF status ON item_decisions
             FOR EACH ROW EXECUTE FUNCTION fn_sync_last_quoted_price()
     """)
+
+
+async def ensure_audit_table(engine: AsyncEngine) -> None:
+    """v2.7: general activity trail (audit_log). Idempotent; safe on any volume."""
+    ddl = """
+    CREATE TABLE IF NOT EXISTS audit_log (
+        id          UUID        NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+        occurred_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        actor       TEXT,
+        action      TEXT        NOT NULL,
+        entity      TEXT        NOT NULL,
+        entity_id   TEXT,
+        details     JSONB       NOT NULL DEFAULT '{}'
+    )
+    """
+    indexes = (
+        "CREATE INDEX IF NOT EXISTS idx_audit_log_entity ON audit_log(entity, entity_id)",
+        "CREATE INDEX IF NOT EXISTS idx_audit_log_occurred ON audit_log(occurred_at DESC)",
+    )
+    async with engine.begin() as conn:
+        await conn.execute(text(ddl))
+        for stmt in indexes:
+            await conn.execute(text(stmt))
+    logger.info("audit_log table ensured")

backend/app/main.py

@@ -7,30 +7,55 @@
 """
 import asyncio
 import logging
+import uuid
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI, Request
+import httpx
+from fastapi import Depends, FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
+from prometheus_fastapi_instrumentator import Instrumentator
+from slowapi import _rate_limit_exceeded_handler
+from slowapi.errors import RateLimitExceeded
+from sqlalchemy import text as sql_text
 from sqlalchemy.exc import IntegrityError
 
+from app.auth import get_current_user
 from app.config import settings
 from app.db.engine import AsyncSessionLocal, engine
 from app.db.init_db import (
     ensure_attachment_table,
+    ensure_audit_table,
     ensure_dashboard_tables,
     ensure_material_topic_column,
     ensure_quote_projects,
     ensure_v26,
 )
+from app.observability import RequestContextMiddleware, setup_logging
 from app.routers import ROUTERS
 from app.services.quote_service import auto_expire_quotes
 from app.utils.errors import AppError
+from app.utils.ratelimit import limiter
 
-logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s — %(message)s")
+setup_logging(settings.LOG_FORMAT)
 logger = logging.getLogger("procurement")
 
+if settings.SENTRY_DSN:
+    # GlitchTip/Sentry exception capture — after setup_logging so the SDK's
+    # own logs go through our formatter too. Disabled entirely without a DSN.
+    import sentry_sdk
+    from sentry_sdk.integrations.fastapi import FastApiIntegration
+
+    sentry_sdk.init(
+        dsn=settings.SENTRY_DSN,
+        environment=settings.ENVIRONMENT,
+        traces_sample_rate=settings.SENTRY_TRACES_SAMPLE_RATE,
+        integrations=[FastApiIntegration()],
+        send_default_pii=False,
+    )
+    logger.info("Sentry/GlitchTip exception capture enabled")
+
 API_V1_PREFIX = "/api/v1"
 
 
@@ -45,13 +70,41 @@ async def _auto_expire_loop() -> None:
             logger.exception("Auto-expiry pass failed")
 
 
+def _verify_production_settings() -> None:
+    """Fail-fast guard: refuse to boot in prod with dev defaults.
+
+    These exact misconfigurations are what previously shipped (wildcard CORS
+    with credentials, default MinIO/Postgres/Casdoor credentials, and the
+    always-on X-User-Role identity fallback). Ops fix: set the real values
+    in the server-side .env — see docs/SECRET-MANAGEMENT.md.
+    """
+    problems: list[str] = []
+    if not settings.cors_origin_list or "*" in settings.cors_origin_list:
+        problems.append("PROCUREMENT_CORS_ORIGINS must list exact origins (no '*')")
+    if settings.MINIO_ACCESS_KEY == "minioadmin" or settings.MINIO_SECRET_KEY == "minioadmin":
+        problems.append("MinIO credentials are still the default minioadmin")
+    if not settings.CASDOOR_CLIENT_SECRET:
+        problems.append("PROCUREMENT_CASDOOR_CLIENT_SECRET is not set")
+    if not settings.CASDOOR_ADMIN_PASSWORD:
+        problems.append("PROCUREMENT_CASDOOR_ADMIN_PASSWORD is not set")
+    if settings.DEV_LOGIN_ENABLED:
+        problems.append("PROCUREMENT_DEV_LOGIN_ENABLED must be false in production")
+    if problems:
+        raise RuntimeError(
+            "Refusing to start in production — fix the environment:\n  - " + "\n  - ".join(problems)
+        )
+
+
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
+    if settings.is_prod:
+        _verify_production_settings()
     await ensure_dashboard_tables(engine)
     await ensure_attachment_table(engine)
     await ensure_material_topic_column(engine)
     await ensure_quote_projects(engine)
     await ensure_v26(engine)
+    await ensure_audit_table(engine)
     task = asyncio.create_task(_auto_expire_loop()) if settings.AUTO_EXPIRE_ENABLED else None
     try:
         yield
@@ -74,11 +127,21 @@ app = FastAPI(
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=settings.CORS_ORIGINS,
+    allow_origins=settings.cors_origin_list,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
 )
+app.add_middleware(RequestContextMiddleware)
+
+# Rate limiting — login brute-force brake (edge rate limit lives in Traefik).
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
+# Prometheus /metrics (requests, latency, errors) — mounted at app level,
+# outside the authenticated /api/v1 prefix; scrape target for the
+# monitoring stack.
+Instrumentator().instrument(app).expose(app, endpoint="/metrics", include_in_schema=False)
 
 
 # ---------------------------------------------------------------------------
@@ -119,6 +182,7 @@ def _fa_validation_msg(msg: str) -> str:
 
 @app.exception_handler(RequestValidationError)
 async def validation_error_handler(_request: Request, exc: RequestValidationError):
+    logger.warning("RequestValidationError on %s: %s", _request.url.path, exc.errors())
     first = exc.errors()[0]
     loc = [str(part) for part in first.get("loc", []) if part not in ("body", "query", "path")]
     field = ".".join(loc) if loc else None
@@ -157,11 +221,72 @@ async def unhandled_error_handler(_request: Request, exc: Exception):
 # ---------------------------------------------------------------------------
 # Routes
 # ---------------------------------------------------------------------------
+# JWT auth is required on EVERY router; the auth router stays public
+# (POST /auth/login issues the tokens) and /health lives below, outside the
+# /api/v1 prefix. Routers with their own finer-grained scopes (inventory,
+# pm, users) keep them — the global dependency guarantees nothing is open
+# by omission.
+from app.routers.auth import router as _auth_router  # noqa: E402
 
 for router in ROUTERS:
-    app.include_router(router, prefix=API_V1_PREFIX)
+    if router is _auth_router:
+        app.include_router(router, prefix=API_V1_PREFIX)
+    else:
+        app.include_router(router, prefix=API_V1_PREFIX, dependencies=[Depends(get_current_user)])
 
 
 @app.get("/health", tags=["system"])
 async def health():
     return {"status": "ok", "service": "procurement-api"}
+
+
+async def _check_db() -> bool:
+    try:
+        async with AsyncSessionLocal() as session:
+            await session.execute(sql_text("SELECT 1"))
+        return True
+    except Exception:
+        logger.exception("readiness: database check failed")
+        return False
+
+
+async def _check_minio() -> bool:
+    try:
+        from app.services.storage import get_client
+
+        get_client().bucket_exists(settings.MINIO_BUCKET)
+        return True
+    except Exception:
+        logger.exception("readiness: MinIO check failed")
+        return False
+
+
+async def _check_casdoor() -> bool:
+    try:
+        async with httpx.AsyncClient(timeout=5) as client:
+            resp = await client.get(
+                settings.CASDOOR_JWKS_URL or f"{settings.CASDOOR_ENDPOINT}/.well-known/jwks"
+            )
+            return resp.status_code == 200
+    except Exception:
+        logger.exception("readiness: Casdoor JWKS check failed")
+        return False
+
+
+@app.get("/health/ready", tags=["system"])
+async def health_ready():
+    """Readiness: verifies the dependencies the API actually needs.
+
+    The deploy webhook polls this after a rebuild, so a deploy that breaks
+    the DB/MinIO/Casdoor connectivity is visible immediately.
+    """
+    checks = {
+        "database": await _check_db(),
+        "minio": await _check_minio(),
+        "casdoor": await _check_casdoor(),
+    }
+    ok = all(checks.values())
+    return JSONResponse(
+        status_code=200 if ok else 503,
+        content={"status": "ok" if ok else "degraded", "service": "procurement-api", "checks": checks},
+    )

backend/app/models/__init__.py

@@ -1,5 +1,6 @@
 """ORM models — import order matters only for registration in Base.metadata."""
 from app.db.base import Base
+from app.models.audit import AuditLog
 from app.models.catalog import (
     AttributeDefinition,
     Brand,

backend/app/models/audit.py

@@ -0,0 +1,19 @@
+"""Audit log model — general activity trail (v2.7)."""
+import uuid
+
+from sqlalchemy import Column, DateTime, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+
+from app.db.base import Base
+
+
+class AuditLog(Base):
+    __tablename__ = "audit_log"
+
+    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    occurred_at = Column(DateTime(timezone=True), nullable=False, server_default=func.now())
+    actor = Column(Text, nullable=True)  # display name of the authenticated user
+    action = Column(String(64), nullable=False)  # e.g. "user.role_changed"
+    entity = Column(String(64), nullable=False)  # e.g. "user", "inventory_tx"
+    entity_id = Column(Text, nullable=True)
+    details = Column(JSONB, nullable=False, server_default="{}")

backend/app/observability.py

@@ -0,0 +1,86 @@
+"""Observability plumbing — logging format, request IDs, request log.
+
+- ``setup_logging()``: human-readable text by default, JSON lines when
+  ``PROCUREMENT_LOG_FORMAT=json`` (what Promtail/Loki prefers).
+- ``request_context`` middleware: assigns an X-Request-ID to every request
+  (honours one sent by the edge), echoes it in the response, and logs one
+  structured line per request (method, path, status, duration, request id)
+  — this is what makes access logs useful in Loki.
+"""
+import contextvars
+import json
+import logging
+import time
+import uuid
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+request_id_var: contextvars.ContextVar[str] = contextvars.ContextVar("request_id", default="-")
+
+_SKIP_ACCESS_LOG = {"/health", "/health/ready", "/metrics"}
+
+
+class JsonFormatter(logging.Formatter):
+    """Minimal JSON-lines formatter for Loki/Promtail ingestion."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        payload = {
+            "ts": self.formatTime(record, "%Y-%m-%dT%H:%M:%S%z"),
+            "level": record.levelname,
+            "logger": record.name,
+            "message": record.getMessage(),
+            "request_id": request_id_var.get(),
+        }
+        if record.exc_info:
+            payload["exception"] = self.formatException(record.exc_info)
+        for key in ("http_method", "http_path", "http_status", "duration_ms"):
+            value = getattr(record, key, None)
+            if value is not None:
+                payload[key] = value
+        return json.dumps(payload, ensure_ascii=False)
+
+
+def setup_logging(log_format: str = "text", level: int = logging.INFO) -> None:
+    formatter = JsonFormatter() if log_format.lower() == "json" else logging.Formatter(
+        "%(asctime)s %(levelname)s %(name)s — %(message)s"
+    )
+    root = logging.getLogger()
+    for handler in root.handlers[:]:
+        root.removeHandler(handler)
+    handler = logging.StreamHandler()
+    handler.setFormatter(formatter)
+    root.addHandler(handler)
+    root.setLevel(level)
+
+
+class RequestContextMiddleware(BaseHTTPMiddleware):
+    """X-Request-ID + one access-log line per request."""
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        rid = request.headers.get("x-request-id") or uuid.uuid4().hex
+        token = request_id_var.set(rid)
+        started = time.perf_counter()
+        try:
+            response = await call_next(request)
+        except Exception:
+            duration_ms = round((time.perf_counter() - started) * 1000, 1)
+            logging.getLogger("procurement.access").exception(
+                "unhandled exception",
+                extra={"http_method": request.method, "http_path": request.url.path,
+                       "http_status": 500, "duration_ms": duration_ms},
+            )
+            request_id_var.reset(token)
+            raise
+        duration_ms = round((time.perf_counter() - started) * 1000, 1)
+        response.headers["X-Request-ID"] = rid
+        request_id_var.reset(token)
+        if request.url.path not in _SKIP_ACCESS_LOG:
+            logging.getLogger("procurement.access").info(
+                "%s %s -> %s",
+                request.method, request.url.path, response.status_code,
+                extra={"http_method": request.method, "http_path": request.url.path,
+                       "http_status": response.status_code, "duration_ms": duration_ms},
+            )
+        return response

backend/app/routers/auth.py

@@ -13,15 +13,17 @@ Error mapping (documented in docs/casdoor-auth.md):
 import logging
 
 import httpx
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import _verify_token, context_from_claims
 from app.config import settings
 from app.db.engine import get_db
-from app.routers.users import _user_project, user_to_dict
+from app.routers.users import _user_projects, user_to_dict
+from app.services import analytics
 from app.utils.errors import ServiceUnavailableError, UnauthorizedError
+from app.utils.ratelimit import limiter
 
 logger = logging.getLogger("procurement.auth")
 
@@ -31,11 +33,11 @@ router = APIRouter(prefix="/auth", tags=["auth"])
 class LoginRequest(BaseModel):
     username: str
     password: str
-    organization: str | None = None  # optional override; defaults to CASDOOR_ORGANIZATION
 
 
 @router.post("/login")
-async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
+@limiter.limit("10/minute", error_message="تلاش‌های ورود بیش از حد مجاز — کمی بعد دوباره امتحان کنید")
+async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depends(get_db)):
     """Exchange username/password for a Casdoor JWT (OAuth password grant)."""
     url = f"{settings.CASDOOR_ENDPOINT}/api/login/oauth/access_token"
     form = {
@@ -75,12 +77,21 @@ async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
     # the app-side user (auto-provision on first login).
     claims = await _verify_token(access_token)
     ctx = await context_from_claims(claims, db)
-    project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
+    projects = await _user_projects(db, ctx.user)
+    await analytics.track(
+        "login_success",
+        {"username": payload.username, "role": ctx.role},
+        profile_id=ctx.user.casdoor_id,
+    )
+    await analytics.identify(
+        ctx.user.casdoor_id,
+        {"name": ctx.display_name, "role": ctx.role, "username": payload.username},
+    )
     return {
         "data": {
             "access_token": access_token,
             "token_type": "bearer",
             "expires_in": body.get("expires_in"),
-            "user": user_to_dict(ctx.user, project),
+            "user": user_to_dict(ctx.user, projects),
         }
     }

backend/app/routers/files.py

@@ -13,11 +13,14 @@ The same four endpoints exist under /proforma. Bytes live in MinIO
 Both invoice and proforma uploads are allowed in every quote status (the
 user can attach the invoice from the edit page at any time).
 """
+import os
 import uuid
+from urllib.parse import quote
 
 from fastapi import APIRouter, Depends, File, Response, UploadFile
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import Quote
 from app.services import file_service
@@ -25,6 +28,10 @@ from app.utils.errors import NotFoundError, ValidationError
 
 router = APIRouter(prefix="/quotes", tags=["files"])
 
+# حذف پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ بارگذاری و دانلود
+# برای هر کاربر واردشده آزاد است.
+_attachment_deleter = require_role("procurement_manager", "admin")
+
 ALLOWED_MIME_TYPES = {
     "image/png", "image/jpeg", "image/webp", "image/gif", "application/pdf",
 }
@@ -34,6 +41,26 @@ ALLOWED_EXTENSIONS = {".png", ".jpg", ".jpeg", ".webp", ".gif", ".pdf"}
 MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024
 
 
+def _content_disposition(file_name: str) -> str:
+    """Header-safe Content-Disposition for non-ASCII (e.g. Persian) filenames.
+
+    HTTP headers are encoded as latin-1, so a Persian name raises
+    UnicodeEncodeError and kills the response. Per RFC 6266 / RFC 5987 the
+    UTF-8 name goes percent-encoded in ``filename*``, with an ASCII fallback
+    in ``filename`` for old clients.
+    """
+    raw = file_name.encode("ascii", "ignore").decode("ascii")
+    # keep the fallback header-safe: no quotes, no control characters
+    fallback = "".join(ch for ch in raw if ch >= " " and ch != '"').strip()
+    ext = os.path.splitext(file_name)[1]
+    stem = fallback[: -len(ext)].strip() if ext and fallback.lower().endswith(ext.lower()) else fallback
+    if not stem or not any(ch.isalnum() for ch in stem):
+        # nothing meaningful survived ASCII-folding (e.g. a pure-Persian
+        # name): use a generic attachment name that keeps the extension
+        fallback = f"attachment{ext}" if ext else "attachment"
+    return f"attachment; filename=\"{fallback}\"; filename*=UTF-8''{quote(file_name)}"
+
+
 async def _quote_or_404(db: AsyncSession, quote_id: uuid.UUID) -> Quote:
     quote = await db.get(Quote, quote_id)
     if quote is None:
@@ -92,13 +119,13 @@ async def download_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: As
         content=content,
         media_type=attachment.mime_type,
         headers={
-            "Content-Disposition": f'attachment; filename="{attachment.file_name}"',
+            "Content-Disposition": _content_disposition(attachment.file_name),
             "X-File-Id": str(attachment.id),
         },
     )
 
 
-@router.delete("/{quote_id}/invoice/{attachment_id}")
+@router.delete("/{quote_id}/invoice/{attachment_id}", dependencies=[Depends(_attachment_deleter)])
 async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "invoice")
@@ -137,13 +164,13 @@ async def download_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: A
         content=content,
         media_type=attachment.mime_type,
         headers={
-            "Content-Disposition": f'attachment; filename="{attachment.file_name}"',
+            "Content-Disposition": _content_disposition(attachment.file_name),
             "X-File-Id": str(attachment.id),
         },
     )
 
 
-@router.delete("/{quote_id}/proforma/{attachment_id}")
+@router.delete("/{quote_id}/proforma/{attachment_id}", dependencies=[Depends(_attachment_deleter)])
 async def delete_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "proforma")

backend/app/routers/inventory.py

@@ -43,6 +43,7 @@ from app.utils.errors import (
     UnauthorizedError,
     ValidationError,
 )
+from app.utils.audit import record as audit_record
 from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
@@ -59,10 +60,18 @@ class Scope:
     actor: str | None
 
 
-async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db)) -> Scope:
-    """Resolve the caller role/project — Casdoor JWT first, dev headers as fallback."""
-    # Primary path: Casdoor JWT. Role from users.role; PM project from
-    # projects.pm_user_id (single PM per project).
+async def inventory_scope(
+    request: Request,
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: داده‌های همین پروژه)"),
+    db: AsyncSession = Depends(get_db),
+) -> Scope:
+    """Resolve the caller role/project — Casdoor JWT first, dev headers as fallback.
+
+    The active project is explicit via `?project_id=…`. For a PM the backend
+    verifies they manage that project (projects.pm_user_id, 1:N); without the
+    param it falls back to their first assigned project. Admin / procurement
+    manager may pass it as a filter (no param = all projects).
+    """
     if request.headers.get("authorization"):
         user: UserContext = await get_optional_user(request, db)
         if user is not None:
@@ -70,33 +79,41 @@ async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db))
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
             # v2.6: مدیر تدارکات = ادمین دفتر — دسترسی فقط‌خواندنی به پنل انبار.
             if user.role == "procurement_manager":
-                return Scope(role="admin", project_id=None, actor=user.display_name)
+                return Scope(role="admin", project_id=project_id, actor=user.display_name)
             if user.role not in ("pm", "admin"):
                 raise ValidationError("نقش نامعتبر است — فقط pm یا admin برای موجودی", field="role")
             if user.role == "pm":
-                if user.project_id is None:
+                allowed = list(user.project_ids or [])
+                if project_id is not None:
+                    if project_id not in allowed:
+                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+                    return Scope(role="pm", project_id=project_id, actor=user.display_name)
+                if not allowed:
                     raise ValidationError(
                         "کاربر PM به هیچ پروژه‌ای متصل نیست (projects.pm_user_id)", field="project_id"
                     )
-                return Scope(role="pm", project_id=user.project_id, actor=user.display_name)
-            return Scope(role="admin", project_id=None, actor=user.display_name)
+                return Scope(role="pm", project_id=allowed[0], actor=user.display_name)
+            return Scope(role="admin", project_id=project_id, actor=user.display_name)
 
     # Dev fallback: header-based identity (fork's placeholder mode) — only
-    # when an explicit X-User-Role header is sent. No auth info at all → 401.
-    if not request.headers.get("x-user-role"):
-        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
+    # when DEV_LOGIN_ENABLED is explicitly turned on (local testing without
+    # Casdoor). Disabled by default: unauthenticated header identity in
+    # production would hand admin access to anyone who can reach the API.
+    if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
+        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     role = (request.headers.get("x-user-role") or settings.INVENTORY_DEFAULT_ROLE or ROLE_PM).strip().lower()
     if role == "procurement_manager":
         role = ROLE_ADMIN  # مدیر تدارکات = ادمین (فقط‌خواندنی)
     if role not in (ROLE_PM, ROLE_ADMIN):
         raise ValidationError("نقش نامعتبر است — فقط pm یا admin", field="X-User-Role")
-    raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
-    project_id = None
-    if raw_project:
-        try:
-            project_id = uuid.UUID(str(raw_project))
-        except ValueError:
-            raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
+    # The explicit query param wins; otherwise the dev header carries it.
+    if project_id is None:
+        raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
+        if raw_project:
+            try:
+                project_id = uuid.UUID(str(raw_project))
+            except ValueError:
+                raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
     if role == ROLE_PM and project_id is None:
         raise ValidationError(
             "برای نقش PM هدر X-Project-Id (پروژه مسئول) الزامی است", field="X-Project-Id"
@@ -478,6 +495,16 @@ async def create_transaction(
             if dest.project_id != scope.project_id:
                 raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
+        await audit_record(
+            db,
+            actor=scope.actor,
+            action="inventory.transaction_created",
+            entity="inventory",
+            entity_id=str(txs[0].inventory_id) if txs else None,
+            details={"type": payload.transaction_type, "quantity": str(payload.quantity),
+                     "warehouse_id": str(payload.warehouse_id),
+                     "tx_ids": [str(tx.id) for tx in txs]},
+        )
     return {"data": [transaction_to_dict(tx) for tx in txs]}
 
 

backend/app/routers/item_decisions.py

@@ -4,11 +4,16 @@ State machine (P1 cross-endpoint rules):
     pending -> chosen (requires chosen_item_termsheet_id of the SAME line item)
     pending -> rejected
     chosen/rejected -> pending/anything-else = 409
+
+Auth: JWT required globally (main.py). The state-changing endpoints are a
+purchase decision — restricted to procurement_manager / admin via
+require_role; reads stay open to every authenticated role.
 """
 from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import ItemDecision, ItemTermsheet, LineItem
 from app.schemas.procurement import DecisionPatch, DecisionPut, DecisionStatusUpdate
@@ -21,6 +26,9 @@ router = APIRouter(
     tags=["item-decisions"],
 )
 
+# خرید/رد اقلام = تصمیم تدارکات؛ ادمین و مدیر تدارکات
+_decision_writer = require_role("procurement_manager", "admin")
+
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
     li = await db.scalar(
@@ -59,7 +67,7 @@ async def get_decision(quote_id, line_item_id, db: AsyncSession = Depends(get_db
     return {"data": decision_full(decision)}
 
 
-@router.put("")
+@router.put("", dependencies=[Depends(_decision_writer)])
 async def put_decision(
     quote_id, line_item_id, payload: DecisionPut, db: AsyncSession = Depends(get_db)
 ):
@@ -93,7 +101,7 @@ async def put_decision(
     return {"data": decision_full(decision), "status_code_hint": 201 if created else 200}
 
 
-@router.patch("/status")
+@router.patch("/status", dependencies=[Depends(_decision_writer)])
 async def patch_decision_status(
     quote_id, line_item_id, payload: DecisionStatusUpdate, db: AsyncSession = Depends(get_db)
 ):
@@ -118,7 +126,7 @@ async def patch_decision_status(
     return {"data": decision_full(decision)}
 
 
-@router.patch("")
+@router.patch("", dependencies=[Depends(_decision_writer)])
 async def patch_decision(
     quote_id, line_item_id, payload: DecisionPatch, db: AsyncSession = Depends(get_db)
 ):

backend/app/routers/line_items.py

@@ -108,6 +108,7 @@ async def update_line_item(
         effective_bm = payload.brand_material_id if payload.brand_material_id is not None else li.brand_material_id
         await ensure_brand_material_belong(db, effective_bm, new_material_id)
 
+    old_material_id = li.material_id
     if payload.material_id is not None:
         li.material_id = payload.material_id
         # v2.5: keep the supplier<->material catalog edge in sync.
@@ -121,6 +122,11 @@ async def update_line_item(
     if payload.notes is not None:
         li.notes = payload.notes
     await db.flush()
+
+    if payload.material_id is not None and payload.material_id != old_material_id:
+        from app.services.quote_service import cleanup_orphan_materials
+        await cleanup_orphan_materials(db, [old_material_id])
+
     return {"data": (await serialize_line_items(db, [li], set()))[0]}
 
 
@@ -133,6 +139,13 @@ async def delete_line_item(quote_id, line_item_id, db: AsyncSession = Depends(ge
     decision = await db.scalar(select(ItemDecision).where(ItemDecision.line_item_id == li.id))
     if decision is not None and decision.status == "chosen":
         raise ConflictError("خط آیتم انتخاب‌شده قابل حذف نیست")
+    old_material_id = li.material_id
     await db.delete(li)  # specs / links / decision / receipt cascade via DDL
     await db.flush()
+
+    if old_material_id:
+        from app.services.quote_service import cleanup_orphan_materials
+        await cleanup_orphan_materials(db, [old_material_id])
+
     return {"data": {"id": str(line_item_id), "deleted": True}}
+

backend/app/routers/pm.py

@@ -19,8 +19,9 @@ Rules enforced here:
   the canonical unit for auto-posted purchases.
 - quote.status flips to 'arrived' when ALL chosen items are fully received.
 
-Auth: Casdoor JWT primary; dev fallback headers (X-User-Role: pm|admin +
-X-Project-Id for pm) when no Authorization header — same pattern as the
+Auth: Casdoor JWT (a global dependency in main.py) resolves the caller;
+optional dev-header fallback (X-User-Role: pm|admin + X-Project-Id for pm)
+exists only when PROCUREMENT_DEV_LOGIN_ENABLED=true — same pattern as the
 inventory router.
 """
 import base64
@@ -29,12 +30,13 @@ from contextlib import nullcontext
 from dataclasses import dataclass
 from decimal import Decimal
 
-from fastapi import APIRouter, Depends, Request
+from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import func, select
 from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_optional_user
+from app.config import settings
 from app.db.engine import get_db
 from app.models.catalog import BrandMaterial, Material, MaterialCategory, Unit
 from app.models.inventory import InventoryItem, InventoryTransaction, Warehouse
@@ -48,6 +50,7 @@ from app.models.procurement import (
     Supplier,
 )
 from app.schemas.procurement import PMReceiptCreate
+from app.services import analytics
 from app.services.inventory_service import canonical_specs_hash
 from app.utils.errors import (
     ForbiddenError,
@@ -66,14 +69,20 @@ NULL_BRAND_SENTINEL = "00000000-0000-0000-0000-000000000000"
 class ArrivalScope:
     role: str  # "pm" | "admin" (admin = admin or procurement_manager)
     user_id: uuid.UUID | None
-    project_id: uuid.UUID | None  # PM's single project; None for admin
+    project_id: uuid.UUID | None  # PM's active project; admin: optional filter
     display_name: str
 
 
-async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -> ArrivalScope:
+async def arrivals_scope(
+    request: Request,
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: الزامی برای داده‌های پروژه)"),
+    db: AsyncSession = Depends(get_db),
+) -> ArrivalScope:
     """Resolve the arrivals caller — Casdoor JWT first, dev headers as fallback.
 
-    PM → scoped to his own project. Admin / procurement manager → all projects.
+    PM → scoped to the requested project, which must be one they manage
+    (projects.pm_user_id, 1:N); without the param, their first project.
+    Admin / procurement manager → all projects (param = optional filter).
     """
     if request.headers.get("authorization"):
         ctx: UserContext | None = await get_optional_user(request, db)
@@ -81,22 +90,30 @@ async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -
             if ctx.role is None:
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
             if ctx.role == "pm":
-                if ctx.project_id is None:
+                allowed = list(ctx.project_ids or [])
+                if project_id is not None:
+                    if project_id not in allowed:
+                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
+                if not allowed:
                     raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=ctx.project_id, display_name=ctx.display_name)
+                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name)
             if ctx.role in ("admin", "procurement_manager"):
-                return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=None, display_name=ctx.display_name)
+                return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
             raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
-    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to admin)
-    if not request.headers.get("x-user-role"):
-        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
+    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to
+    # admin) — ONLY when DEV_LOGIN_ENABLED (local testing without Casdoor).
+    # Disabled by default: an ungated header identity in production would
+    # let anyone confirm receipts as PM.
+    if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
+        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     role = (request.headers.get("x-user-role") or "").strip().lower()
     if role == "procurement_manager":
         role = "admin"
     if role not in ("pm", "admin"):
         raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است — هدر X-User-Role را بفرستید")
-    project_id = None
-    if role == "pm":
+    # The explicit query param wins; otherwise the dev header carries it.
+    if project_id is None and role == "pm":
         raw_project = request.headers.get("x-project-id")
         if not raw_project:
             raise ForbiddenError("هدر X-Project-Id (پروژه مسئول) الزامی است")
@@ -172,9 +189,10 @@ async def pm_on_the_way(
         .outerjoin(Project, Project.id == ItemDecision.project_id)
         .where(ItemDecision.status == "chosen")
     )
-    if ctx.role == "pm":
-        if ctx.project_id is None:
-            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.role == "pm" and ctx.project_id is None:
+        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.project_id is not None:
+        # PM: active project; admin/manager: optional project filter
         stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
     decisions = (await db.execute(stmt.order_by(ItemDecision.decided_at.desc().nulls_last()))).all()
 
@@ -238,8 +256,8 @@ async def pm_confirm_receipt(
         decision = await db.get(ItemDecision, payload.item_decision_id)
         if decision is None or decision.status != "chosen":
             raise NotFoundError("تصمیم خرید یافت نشد", field="item_decision_id")
-        if ctx.role == "pm" and decision.project_id != ctx.project_id:
-            raise ForbiddenError("این قلم متعلق به پروژه شما نیست")
+        if ctx.project_id is not None and decision.project_id != ctx.project_id:
+            raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")
 
         li = await db.get(LineItem, decision.line_item_id)
         quote = await db.get(Quote, li.quote_id)
@@ -412,6 +430,16 @@ async def pm_confirm_receipt(
             quote.arrived_date = payload.received_at
 
     item_state = arrival_state(li.quantity, already_received + payload.received_qty)
+    await analytics.track(
+        "receipt_confirmed",
+        {
+            "receipt_id": str(receipt.id),
+            "quote_id": str(quote.id),
+            "quantity": str(payload.received_qty),
+            "state": item_state,
+        },
+        profile_id=ctx.display_name,
+    )
     return {"data": {
         "receipt_id": str(receipt.id),
         "state": item_state,
@@ -436,9 +464,10 @@ async def pm_receipts(
         .join(Quote, Quote.id == LineItem.quote_id)
         .join(Project, Project.id == ItemDecision.project_id)
     )
-    if ctx.role == "pm":
-        if ctx.project_id is None:
-            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.role == "pm" and ctx.project_id is None:
+        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.project_id is not None:
+        # PM: active project; admin/manager: optional project filter
         stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
     rows = (await db.execute(stmt.order_by(ItemReceipt.received_at.desc()))).all()
     receipts = [r.ItemReceipt for r in rows]

backend/app/routers/projects.py

@@ -1,19 +1,25 @@
 """Projects CRUD + per-project stats."""
-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import UserContext, get_optional_user
 from app.db.engine import get_db
 from app.models.procurement import Project, Quote, User
 from app.schemas.procurement import ProjectCreate, ProjectUpdate
 from app.services.quote_service import project_stats
-from app.utils.errors import ConflictError, NotFoundError
+from app.utils.errors import ConflictError, ForbiddenError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_date, to_iso
 
 router = APIRouter(prefix="/projects", tags=["projects"])
 
 
+async def _optional_ctx(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext | None:
+    """JWT caller when present — used for RBAC on PM assignment (PATCH)."""
+    return await get_optional_user(request, db)
+
+
 async def _pm_map(db: AsyncSession, projects: list[Project]) -> dict:
     """project_id -> pm brief (v2.6: the single PM of the project)."""
     pm_ids = {p.pm_user_id for p in projects if p.pm_user_id}
@@ -91,7 +97,13 @@ async def get_project(project_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{project_id}")
-async def update_project(project_id, payload: ProjectUpdate, db: AsyncSession = Depends(get_db)):
+async def update_project(
+    project_id,
+    payload: ProjectUpdate,
+    request: Request,
+    ctx: UserContext | None = Depends(_optional_ctx),
+    db: AsyncSession = Depends(get_db),
+):
     project = await db.get(Project, project_id)
     if project is None:
         raise NotFoundError("پروژه یافت نشد")
@@ -101,6 +113,21 @@ async def update_project(project_id, payload: ProjectUpdate, db: AsyncSession =
         project.description = payload.description
     if payload.start_date is not None:
         project.start_date = payload.start_date
+    # PM assignment (1:N): one PM per project, a PM may own many projects.
+    # Admin / procurement manager only (same rule as the Organization panel).
+    if "pm_user_id" in payload.model_fields_set:
+        role = ctx.role if ctx else (request.headers.get("x-user-role") or "").strip().lower()
+        if role not in ("admin", "procurement_manager"):
+            raise ForbiddenError("تعیین مدیر پروژه فقط برای ادمین / مدیر تدارکات مجاز است")
+        if payload.pm_user_id is None:
+            project.pm_user_id = None
+        else:
+            pm_user = await db.get(User, payload.pm_user_id)
+            if pm_user is None:
+                raise NotFoundError("کاربر یافت نشد", field="pm_user_id")
+            if pm_user.role != "pm":
+                raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="pm_user_id")
+            project.pm_user_id = pm_user.id
     await db.flush()
     return {"data": await project_to_dict(db, project)}
 

backend/app/routers/users.py

@@ -1,12 +1,14 @@
 """Users — profile + role assignment + organization management (v2.6, Casdoor-backed).
 
 Organization panel endpoints (admin / procurement manager — same person):
-- GET  /users                — list every user with role + assigned project.
+- GET  /users                — list every user with role + assigned projects.
 - POST /users                — define a new user (manual identity, casdoor_id optional).
 - PATCH /users/{id}          — set/clear role; clearing (or switching away from
-                               «pm») also unassigns the user from their project.
-- POST /users/{id}/project   — assign/unassign the user's single project
-                               (project_id=None unassigns; one PM per project).
+                               «pm») also unassigns the user from every project.
+- POST /users/{id}/project   — assign/unassign ONE project (multi-project:
+                               other assignments are kept; project_id=None
+                               clears all; one PM per project).
+- GET  /users/me/projects    — every project assigned to the caller (PM).
 
 Role management is open to BOTH «admin» and «procurement_manager» (they are
 the same person in this system), unlike the plain require_role("admin").
@@ -19,6 +21,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
+from app.utils.audit import record as audit_record
 from app.config import settings
 from app.db.engine import get_db
 from app.models.procurement import Project, User
@@ -41,7 +44,11 @@ USER_ROLE_LABELS = {
 }
 
 
-def user_to_dict(user: User, project: Project | None = None) -> dict:
+def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
+    """Serialize a user. `projects` = every project the PM manages (1:N);
+    project_id/project_name stay as the first (oldest) one for compatibility."""
+    projects = projects or []
+    first = projects[0] if projects else None
     return {
         "id": str(user.id),
         "casdoor_id": user.casdoor_id,
@@ -50,8 +57,9 @@ def user_to_dict(user: User, project: Project | None = None) -> dict:
         "phone": user.phone,
         "role": user.role,
         "role_label": USER_ROLE_LABELS.get(user.role) if user.role else None,
-        "project_id": str(project.id) if project else None,
-        "project_name": project.name if project else None,
+        "project_id": str(first.id) if first else None,
+        "project_name": first.name if first else None,
+        "projects": [{"id": str(p.id), "name": p.name} for p in projects],
         "created_at": to_iso(user.created_at),
     }
 
@@ -63,14 +71,28 @@ async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserCont
     return ctx
 
 
-async def _user_project(db: AsyncSession, user: User) -> Project | None:
+async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
+    """Every project the user manages as PM (oldest first; [] for non-PMs)."""
     if user.role != "pm":
-        return None
-    return await db.scalar(select(Project).where(Project.pm_user_id == user.id))
+        return []
+    rows = (
+        await db.execute(
+            select(Project)
+            .where(Project.pm_user_id == user.id)
+            .order_by(Project.created_at, Project.id)
+        )
+    ).scalars().all()
+    return list(rows)
+
+
+async def _user_project(db: AsyncSession, user: User) -> Project | None:
+    """First (oldest) project of a PM — legacy single-project view."""
+    projects = await _user_projects(db, user)
+    return projects[0] if projects else None
 
 
 async def _unassign_projects(db: AsyncSession, user_id) -> None:
-    """Clear the user's pm assignment on every project (one project per PM)."""
+    """Clear the user's pm assignment on every project (role revocation)."""
     await db.execute(
         update(Project).where(Project.pm_user_id == user_id).values(pm_user_id=None)
     )
@@ -104,8 +126,19 @@ async def _casdoor_users() -> list[dict]:
 
 @router.get("/me")
 async def me(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
-    project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
-    return {"data": user_to_dict(ctx.user, project)}
+    projects = await _user_projects(db, ctx.user)
+    return {"data": user_to_dict(ctx.user, projects)}
+
+
+@router.get("/me/projects")
+async def my_projects(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
+    """Every project assigned to the caller (empty list for non-PM roles).
+
+    Drives the PM project switcher: the frontend validates its persisted
+    active project against this list and falls back gracefully when a
+    project is revoked."""
+    projects = await _user_projects(db, ctx.user)
+    return {"data": [{"id": str(p.id), "name": p.name} for p in projects]}
 
 
 @router.get("")
@@ -113,15 +146,22 @@ async def list_users(
     _: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
-    """Every user (with role + assigned project) — Organization panel."""
+    """Every user (with role + assigned projects) — Organization panel."""
     users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
     pm_ids = {u.id for u in users if u.role == "pm"}
-    projects: dict = {}
+    by_user: dict = {}
     if pm_ids:
-        projs = (await db.execute(select(Project).where(Project.pm_user_id.in_(pm_ids)))).scalars().all()
-        projects = {p.pm_user_id: p for p in projs}
+        projs = (
+            await db.execute(
+                select(Project)
+                .where(Project.pm_user_id.in_(pm_ids))
+                .order_by(Project.created_at, Project.id)
+            )
+        ).scalars().all()
+        for p in projs:
+            by_user.setdefault(p.pm_user_id, []).append(p)
     return {
-        "data": [user_to_dict(u, projects.get(u.id)) for u in users],
+        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
         "meta": {"total": len(users)},
     }
 
@@ -129,7 +169,7 @@ async def list_users(
 @router.post("", status_code=201)
 async def create_user(
     payload: UserCreate,
-    _: UserContext = Depends(_org_manager),
+    ctx: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
     """Define a new user (manual identity — casdoor_id optional)."""
@@ -146,6 +186,7 @@ async def create_user(
     )
     db.add(user)
     await db.flush()
+    await audit_record(db, actor=ctx.display_name, action="user.created", entity="user", entity_id=str(user.id), details={"role": payload.role})
     return {"data": user_to_dict(user)}
 
 
@@ -153,7 +194,7 @@ async def create_user(
 async def update_user_role(
     user_id,
     payload: UserRoleUpdate,
-    _: UserContext = Depends(require_role("admin")),
+    ctx: UserContext = Depends(require_role("admin")),
     db: AsyncSession = Depends(get_db),
 ):
     """Set/clear a role — ADMIN ONLY (RBAC): procurement managers must not
@@ -162,12 +203,14 @@ async def update_user_role(
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
+    previous_role = user.role
     if user.role == "pm" and payload.role != "pm":
         await _unassign_projects(db, user.id)
     user.role = payload.role
     await db.flush()
-    project = await _user_project(db, user)
-    return {"data": user_to_dict(user, project)}
+    await audit_record(db, actor=ctx.display_name, action="user.role_changed", entity="user", entity_id=str(user.id), details={"from": previous_role, "to": payload.role})
+    projects = await _user_projects(db, user)
+    return {"data": user_to_dict(user, projects)}
 
 
 @router.post("/sync")
@@ -204,12 +247,19 @@ async def sync_casdoor_users(
 
     users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
     pm_ids = {u.id for u in users if u.role == "pm"}
-    projects: dict = {}
+    by_user: dict = {}
     if pm_ids:
-        projs = (await db.execute(select(Project).where(Project.pm_user_id.in_(pm_ids)))).scalars().all()
-        projects = {p.pm_user_id: p for p in projs}
+        projs = (
+            await db.execute(
+                select(Project)
+                .where(Project.pm_user_id.in_(pm_ids))
+                .order_by(Project.created_at, Project.id)
+            )
+        ).scalars().all()
+        for p in projs:
+            by_user.setdefault(p.pm_user_id, []).append(p)
     return {
-        "data": [user_to_dict(u, projects.get(u.id)) for u in users],
+        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
         "meta": {"total": len(users), "created": created},
     }
 
@@ -221,11 +271,13 @@ async def assign_user_project(
     _: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
-    """Assign the user as PM of one project (project_id=None unassigns).
+    """Assign the user as PM of ONE project (multi-project aware).
 
-    Rules: the user must hold the «pm» role; a PM manages ONE project at a
-    time (assignment on other projects is cleared); assigning a new PM to a
-    project replaces the previous PM there.
+    - project_id given: that project gets this PM (a previous PM there is
+      replaced); the user's OTHER project assignments are kept.
+    - project_id=None: clears ALL of the user's project assignments.
+
+    Rules: the user must hold the «pm» role; a project has at most one PM.
     """
     user = await db.get(User, user_id)
     if user is None:
@@ -233,8 +285,8 @@ async def assign_user_project(
     if user.role != "pm":
         raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="role")
 
-    await _unassign_projects(db, user.id)
     if payload.project_id is None:
+        await _unassign_projects(db, user.id)
         await db.flush()
         return {"data": user_to_dict(user)}
 
@@ -243,4 +295,4 @@ async def assign_user_project(
         raise NotFoundError("پروژه یافت نشد", field="project_id")
     project.pm_user_id = user.id
     await db.flush()
-    return {"data": user_to_dict(user, project)}
+    return {"data": user_to_dict(user, await _user_projects(db, user))}

backend/app/schemas/procurement.py

@@ -52,6 +52,9 @@ class ProjectUpdate(APIModel):
     name: str | None = Field(default=None, min_length=1)
     description: str | None = None
     start_date: date | None = None
+    # PM assignment (1:N — one PM per project, a PM may own many projects).
+    # Admin / procurement manager only; None unassigns this project's PM.
+    pm_user_id: UUID | None = None
 
 
 # ---------------------------------------------------------------------------
@@ -210,7 +213,11 @@ class UserRoleUpdate(APIModel):
 
 
 class UserProjectUpdate(APIModel):
-    """Assign/unassign the user's single project (project_id=None unassigns)."""
+    """Assign the user to one project (multi-project aware).
+
+    project_id given → that project gets this PM (previous PM replaced,
+    the user's other projects kept); None → clears every assignment.
+    """
 
     project_id: UUID | None = None
 

backend/app/services/analytics.py

@@ -0,0 +1,76 @@
+"""Server-side product analytics — OpenPanel Track API.
+
+Fire-and-forget business events (quote lifecycle, receipts, logins) so the
+OpenPanel dashboards show what actually happens inside the ERP, not just
+page views. Never raises: analytics must not break a business flow.
+
+Configuration (all optional — disabled when any is missing):
+    PROCUREMENT_OPENPANEL_API_URL     e.g. http://openpanel-api:3333 (self-hosted)
+    PROCUREMENT_OPENPANEL_CLIENT_ID   project client id (write mode)
+    PROCUREMENT_OPENPANEL_CLIENT_SECRET  project client secret
+
+Contract (OpenPanel Track API): POST {API_URL}/track with headers
+``openpanel-client-id`` / ``openpanel-client-secret`` and a JSON body
+``{"type": "track"|"identify", "profileId": ..., "event"/"properties": ...}``.
+"""
+import logging
+from typing import Any
+
+import httpx
+
+from app.config import settings
+
+logger = logging.getLogger("procurement.analytics")
+
+_TIMEOUT = httpx.Timeout(3.0)
+
+
+def _configured() -> bool:
+    return bool(
+        settings.OPENPANEL_API_URL
+        and settings.OPENPANEL_CLIENT_ID
+        and settings.OPENPANEL_CLIENT_SECRET
+    )
+
+
+async def track(event: str, properties: dict[str, Any] | None = None, profile_id: str | None = None) -> None:
+    """Record a named event; swallows every error."""
+    if not _configured():
+        return
+    body = {
+        "type": "track",
+        "event": event,
+        "properties": properties or {},
+    }
+    if profile_id:
+        body["profileId"] = profile_id
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            await client.post(
+                f"{settings.OPENPANEL_API_URL.rstrip('/')}/track",
+                json=body,
+                headers={
+                    "openpanel-client-id": settings.OPENPANEL_CLIENT_ID,
+                    "openpanel-client-secret": settings.OPENPANEL_CLIENT_SECRET,
+                },
+            )
+    except Exception as exc:  # noqa: BLE001 — analytics must never raise
+        logger.debug("analytics track failed (%s): %s", event, exc)
+
+
+async def identify(profile_id: str, properties: dict[str, Any] | None = None) -> None:
+    """Create/update a user profile (e.g. on login)."""
+    if not _configured():
+        return
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            await client.post(
+                f"{settings.OPENPANEL_API_URL.rstrip('/')}/track",
+                json={"type": "identify", "profileId": profile_id, "properties": properties or {}},
+                headers={
+                    "openpanel-client-id": settings.OPENPANEL_CLIENT_ID,
+                    "openpanel-client-secret": settings.OPENPANEL_CLIENT_SECRET,
+                },
+            )
+    except Exception as exc:  # noqa: BLE001
+        logger.debug("analytics identify failed: %s", exc)

backend/app/services/expand_service.py

@@ -77,13 +77,14 @@ def project_brief(project: Project | None) -> dict | None:
     return {"id": str(project.id), "name": project.name}
 
 
-def decision_brief(d: ItemDecision) -> dict:
+def decision_brief(d: ItemDecision, project: Project | None = None) -> dict:
     """Shape used inside expanded line items (P0-14)."""
     return {
         "id": str(d.id),
         "status": d.status,
         "chosen_item_termsheet_id": str(d.chosen_item_termsheet_id) if d.chosen_item_termsheet_id else None,
         "project_id": str(d.project_id) if d.project_id else None,  # v2.6: the single purchased project
+        "project": project_brief(project) if project is not None else None,
         "adjusted_unit_price": float(d.adjusted_unit_price) if d.adjusted_unit_price is not None else None,
         "decided_at": to_iso(d.decided_at),
     }
@@ -313,6 +314,7 @@ class _LineItemData:
         self.item_termsheets_by_line: dict[uuid.UUID, list[ItemTermsheet]] = {}
         self.item_termsheets_by_id: dict[uuid.UUID, ItemTermsheet] = {}
         self.projects_by_line: dict[uuid.UUID, list[Project]] = {}
+        self.projects_by_id: dict[uuid.UUID, Project] = {}
 
 
 async def _load_line_item_data(db: AsyncSession, line_items: list[LineItem], expand: set[str]) -> _LineItemData:
@@ -375,6 +377,13 @@ async def _load_line_item_data(db: AsyncSession, line_items: list[LineItem], exp
     if "decision" in expand or "receipt" in expand:
         decisions = (await db.execute(select(ItemDecision).where(ItemDecision.line_item_id.in_(li_ids)))).scalars().all()
         data.decisions = {d.line_item_id: d for d in decisions}
+        dec_proj_ids = {d.project_id for d in decisions if d.project_id is not None}
+        missing_pids = dec_proj_ids - set(proj_map.keys())
+        if missing_pids:
+            extra_projs = (await db.execute(select(Project).where(Project.id.in_(missing_pids)))).scalars().all()
+            for p in extra_projs:
+                proj_map[p.id] = p
+        data.projects_by_id = proj_map
         dec_ids = [d.id for d in decisions]
         if dec_ids:
             receipts = (await db.execute(select(ItemReceipt).where(ItemReceipt.item_decision_id.in_(dec_ids)))).scalars().all()
@@ -469,8 +478,10 @@ def _line_item_expanded(li: LineItem, expand: set[str], data: _LineItemData, inc
             data.specs_by_line.get(li.id, []), data.attr_defs, data.units, include_data_type=False
         )
     decision = data.decisions.get(li.id)
+    dec_proj = data.projects_by_id.get(decision.project_id) if decision and decision.project_id else None
+    d["target_project"] = project_brief(dec_proj) if dec_proj is not None else None
     if "decision" in expand:
-        d["decision"] = decision_brief(decision) if decision is not None else None
+        d["decision"] = decision_brief(decision, dec_proj) if decision is not None else None
         # chosen_item_termsheet_id یک id از جدول item_termsheets است؛ برای مقایسه با
         # termsheet_ids در جلوی برنامه، id ترم‌شیت واقعی هم ارسال می‌شود.
         if decision is not None and decision.chosen_item_termsheet_id is not None:

backend/app/services/quote_service.py

@@ -4,6 +4,7 @@ Every mutation here runs in ONE ``async with db.begin()`` block; any failure
 rolls the whole operation back. All state changes log a quote_event in the
 same transaction.
 """
+import asyncio
 import logging
 from datetime import date, datetime, timezone
 from uuid import UUID
@@ -33,6 +34,7 @@ from app.schemas.procurement import (
     QuoteUpdate,
     RejectQuoteIn,
 )
+from app.services import analytics
 from app.services.material_service import ensure_brand_material_belong
 from app.utils.errors import ConflictError, NotFoundError, ValidationError
 
@@ -56,6 +58,19 @@ def utcnow() -> datetime:
 
 def _add_event(db: AsyncSession, quote_id: UUID, event_type: str, payload: dict | None = None, actor: str | None = None) -> None:
     db.add(QuoteEvent(quote_id=quote_id, event_type=event_type, payload=payload or {}, actor=actor))
+    # Product analytics (fire-and-forget, never blocks or raises): the whole
+    # quote lifecycle funnels through here, so one hook covers every
+    # status transition for the OpenPanel dashboards.
+    try:
+        asyncio.get_running_loop().create_task(
+            analytics.track(
+                f"quote_{event_type}",
+                {"quote_id": str(quote_id), "actor": actor, **(payload or {})},
+                profile_id=actor,
+            )
+        )
+    except RuntimeError:  # no running loop (defensive — callers are async)
+        pass
 
 
 async def get_quote_or_404(db: AsyncSession, quote_id: UUID) -> Quote:
@@ -279,13 +294,89 @@ async def update_quote(db: AsyncSession, quote_id: UUID, payload: QuoteUpdate, a
     return quote
 
 
+async def quote_has_receipts(db: AsyncSession, quote_id: UUID) -> bool:
+    """Returns True if any warehouse receipt has been posted for the quote's items."""
+    count = await db.scalar(
+        select(func.count(ItemReceipt.id))
+        .join(ItemDecision, ItemReceipt.item_decision_id == ItemDecision.id)
+        .join(LineItem, ItemDecision.line_item_id == LineItem.id)
+        .where(LineItem.quote_id == quote_id, ItemReceipt.received_qty > 0)
+    )
+    return (count or 0) > 0
+
+
+async def cleanup_orphan_materials(db: AsyncSession, material_ids) -> list[UUID]:
+    """Check candidate material_ids and purge any that have zero references.
+
+    A material is considered an orphan if:
+    1. It is not referenced by ANY line_items across all quotes.
+    2. It is not referenced by ANY inventory stock items in warehouses.
+
+    If count == 0:
+    - Auxiliary records in supplier_materials, brand_materials, material_units,
+      and material_attribute_values are cleaned up.
+    - The material row is deleted from the central materials table.
+
+    Returns the list of purged material UUIDs.
+    """
+    purged: list[UUID] = []
+    unique_ids = {m for m in material_ids if m is not None}
+    if not unique_ids:
+        return purged
+
+    from app.models.catalog import (
+        BrandMaterial,
+        Material,
+        MaterialAttributeValue,
+        MaterialUnit,
+    )
+    from app.models.inventory import InventoryItem
+    from app.models.procurement import LineItem, SupplierMaterial
+
+    for mat_id in unique_ids:
+        # Check active usage in line_items across the whole system
+        line_item_count = await db.scalar(
+            select(func.count(LineItem.id)).where(LineItem.material_id == mat_id)
+        )
+        if (line_item_count or 0) > 0:
+            continue
+
+        # Check active usage in warehouse inventory
+        inv_count = await db.scalar(
+            select(func.count(InventoryItem.id)).where(InventoryItem.material_id == mat_id)
+        )
+        if (inv_count or 0) > 0:
+            continue
+
+        # Material is not used in ANY line item and not in ANY warehouse inventory: pure orphan!
+        await db.execute(
+            delete(SupplierMaterial).where(SupplierMaterial.material_id == mat_id)
+        )
+        await db.execute(
+            delete(BrandMaterial).where(BrandMaterial.material_id == mat_id)
+        )
+        await db.execute(
+            delete(MaterialUnit).where(MaterialUnit.material_id == mat_id)
+        )
+        await db.execute(
+            delete(MaterialAttributeValue).where(MaterialAttributeValue.material_id == mat_id)
+        )
+        await db.execute(
+            delete(Material).where(Material.id == mat_id)
+        )
+        purged.append(mat_id)
+        logger.info("Purged orphan material %s from central catalog", mat_id)
+
+    return purged
+
+
 async def replace_quote_children(
     db: AsyncSession, quote_id: UUID, payload: QuoteChildrenReplaceIn, actor: str | None = None
 ) -> Quote:
     """Full replacement of a quote's line items + termsheets (edit modal).
 
-    Only allowed while the quote is still offered — acceptance data
-    (decisions/receipts) would otherwise be destroyed.
+    Only allowed while the quote is still offered and has no warehouse receipts.
+    Automatically purges any materials detached during this replacement if they become orphans.
     """
     async with db.begin():
         quote = await get_quote_or_404(db, quote_id)
@@ -294,6 +385,16 @@ async def replace_quote_children(
                 "برای تغییر اقلام یا شرایط پرداخت، ابتدا وضعیت را به «پیشنهاد شده» برگردانید",
                 field="status",
             )
+        if await quote_has_receipts(db, quote.id):
+            raise ConflictError(
+                "این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.",
+                field="status",
+            )
+
+        # 1. Pre-update snapshot: record previous material_ids assigned to this quote's items
+        old_items = (await db.execute(select(LineItem).where(LineItem.quote_id == quote.id))).scalars().all()
+        old_material_ids = {li.material_id for li in old_items if li.material_id is not None}
+
         # children cascade via DDL: item_termsheets, item_decisions, item_receipts, schedule_steps
         await db.execute(
             delete(LineItem).where(LineItem.quote_id == quote.id).execution_options(synchronize_session=False)
@@ -302,16 +403,33 @@ async def replace_quote_children(
             delete(Termsheet).where(Termsheet.quote_id == quote.id).execution_options(synchronize_session=False)
         )
         await _insert_children(db, quote.id, quote.supplier_id, payload.line_items, payload.termsheets, payload.item_termsheets)
+        await db.flush()
+
+        # 2. Identify detached materials: previous materials no longer present in the updated line items
+        new_material_ids = {li.material_id for li in payload.line_items if li.material_id is not None}
+        detached_material_ids = old_material_ids - new_material_ids
+
+        # 3. Clean up any detached materials that are now orphans (0 usage)
+        if detached_material_ids:
+            await cleanup_orphan_materials(db, detached_material_ids)
+
         _add_event(db, quote.id, "edited", {"changed_fields": ["line_items", "termsheets"]}, actor)
     return quote
 
 
+
 async def _apply_status_transition(db: AsyncSession, quote: Quote, new_status: str) -> None:
     """Backward transitions only; reverts bookkeeping when going back to offered."""
     current = quote.status
     if new_status not in BACKWARD_TRANSITIONS.get(current, set()):
         raise ConflictError("انتقال وضعیت مجاز نیست — فقط انتقال‌های عقب‌گرد پذیرفته می‌شود", field="status")
 
+    if await quote_has_receipts(db, quote.id):
+        raise ConflictError(
+            "این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.",
+            field="status",
+        )
+
     if new_status == "offered":
         # Reopen: clear lifecycle dates, demote accepted termsheets, reset decisions.
         quote.accepted_date = None
@@ -325,17 +443,18 @@ async def _apply_status_transition(db: AsyncSession, quote: Quote, new_status: s
         li_ids = select(LineItem.id).where(LineItem.quote_id == quote.id)
         await db.execute(
             update(ItemDecision)
-            .where(ItemDecision.line_item_id.in_(li_ids), ItemDecision.status != "pending")
+            .where(ItemDecision.line_item_id.in_(li_ids))
             .values(
                 status="pending",
                 decided_at=None,
                 chosen_item_termsheet_id=None,
                 adjusted_unit_price=None,
                 adjusted_notes=None,
+                project_id=None,
             )
             .execution_options(synchronize_session=False)
         )
-        # item_receipts are deliberately NOT deleted (contract P0-17).
+        # LineItemProjects (candidate projects) are preserved untouched!
     elif new_status == "accepted":  # arrived -> accepted
         quote.arrived_date = None
 
@@ -502,21 +621,7 @@ async def accept_quote(db: AsyncSession, quote_id: UUID, payload: AcceptQuoteIn,
                 decision.adjusted_notes = decision_in.adjusted_notes
                 decision.decided_at = utcnow()
 
-        # --- per-material project allocation (تخصیص پروژه به هر قلم) ---
-        for entry in payload.item_projects:
-            if entry.line_item_id not in li_ids:
-                raise NotFoundError(
-                    "خط آیتم یافت نشد یا متعلق به این پیشنهاد نیست", field="item_projects"
-                )
-            await db.execute(
-                delete(LineItemProjects)
-                .where(LineItemProjects.line_item_id == entry.line_item_id)
-                .execution_options(synchronize_session=False)
-            )
-            for pid in entry.project_ids:
-                if await db.get(Project, pid) is None:
-                    raise NotFoundError("پروژه یافت نشد", field="item_projects.project_ids")
-                db.add(LineItemProjects(line_item_id=entry.line_item_id, project_id=pid))
+        # LineItemProjects records in PostgreSQL remain 100% untouched. Only item_decisions.project_id is written.
 
         # termsheets referenced by at least one chosen item -> accepted
         if chosen_ts_ids:
@@ -692,7 +797,8 @@ async def expire_quote(db: AsyncSession, quote_id: UUID, actor: str | None = Non
 
 
 async def delete_quote(db: AsyncSession, quote_id: UUID) -> dict:
-    async with db.begin():
+    tx = db.begin_nested() if db.in_transaction() else db.begin()
+    async with tx:
         quote = await get_quote_or_404(db, quote_id)
         if quote.status in ("accepted", "arrived"):
             raise ConflictError("پیشنهادهای پذیرفته‌شده یا رسیده قابل حذف نیستند")
@@ -712,18 +818,49 @@ async def delete_quote(db: AsyncSession, quote_id: UUID) -> dict:
         termsheets = (await db.execute(select(Termsheet).where(Termsheet.quote_id == quote.id))).scalars().all()
         events = (await db.execute(select(QuoteEvent).where(QuoteEvent.quote_id == quote.id))).scalars().all()
 
+        # collect candidate material_ids for orphan cleanup before deleting quote
+        candidate_material_ids = [li.material_id for li in line_items if li.material_id is not None]
+
+        # collect attachment keys before deleting quote row
+        from app.models.files import QuoteAttachment
+        from app.services import storage
+
+        attachments = (await db.execute(select(QuoteAttachment).where(QuoteAttachment.quote_id == quote.id))).scalars().all()
+        att_keys = [att.object_key for att in attachments]
+        quote_prefix = f"{quote.id}/"
+
         await db.delete(quote)
-        return {
-            "id": str(quote.id),
-            "deleted": True,
-            "cascaded": {
-                "line_items": len(line_items),
-                "termsheets": len(termsheets),
-                "events": len(events),
-                "decisions": len(decisions),
-                "receipts": len(receipts),
-            },
-        }
+        await db.flush()
+
+        # Purge any materials that no longer have any references in the system
+        purged_material_ids = await cleanup_orphan_materials(db, candidate_material_ids)
+
+    # Post-commit: clean up attachments in MinIO (best-effort; DB is already committed)
+    for key in att_keys:
+        try:
+            await storage.remove_object(key)
+        except Exception:
+            logger.warning("Failed to remove MinIO object %s for quote %s", key, quote_id)
+    try:
+        await storage.remove_prefix(quote_prefix)
+    except Exception:
+        logger.warning("Failed to remove MinIO prefix %s for quote %s", quote_prefix, quote_id)
+
+    return {
+        "id": str(quote_id),
+        "deleted": True,
+        "cascaded": {
+            "line_items": len(line_items),
+            "termsheets": len(termsheets),
+            "events": len(events),
+            "decisions": len(decisions),
+            "receipts": len(receipts),
+            "attachments": len(attachments),
+            "purged_orphan_materials": len(purged_material_ids),
+        },
+    }
+
+
 
 
 # ---------------------------------------------------------------------------

backend/app/services/storage.py

@@ -66,3 +66,22 @@ async def remove_object(key: str) -> None:
         await asyncio.to_thread(get_client().remove_object, settings.MINIO_BUCKET, key)
     except Exception:
         logger.warning("Could not remove MinIO object %r — ignoring", key)
+
+
+async def remove_prefix(prefix: str) -> None:
+    """Delete all objects matching a prefix in the bucket (best-effort)."""
+    client = get_client()
+
+    def _sync_remove_prefix():
+        try:
+            objects = client.list_objects(settings.MINIO_BUCKET, prefix=prefix, recursive=True)
+            for obj in objects:
+                try:
+                    client.remove_object(settings.MINIO_BUCKET, obj.object_name)
+                except Exception:
+                    logger.warning("Could not remove MinIO object %r under prefix %r", obj.object_name, prefix)
+        except Exception:
+            logger.warning("Could not list MinIO objects under prefix %r — ignoring", prefix)
+
+    await asyncio.to_thread(_sync_remove_prefix)
+

backend/app/utils/audit.py

@@ -0,0 +1,41 @@
+"""Audit helper — one row per sensitive mutation, written in the SAME
+transaction as the change (rolled back together with it).
+
+    await record(db, actor=ctx.display_name, action="user.role_changed",
+                 entity="user", entity_id=str(user.id),
+                 details={"from": old_role, "to": user.role})
+
+Never raises: an audit failure must not fail the business operation.
+"""
+import logging
+from typing import Any
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.audit import AuditLog
+
+logger = logging.getLogger("procurement.audit")
+
+
+async def record(
+    db: AsyncSession,
+    *,
+    actor: str | None,
+    action: str,
+    entity: str,
+    entity_id: str | None = None,
+    details: dict[str, Any] | None = None,
+) -> None:
+    try:
+        db.add(
+            AuditLog(
+                actor=actor,
+                action=action,
+                entity=entity,
+                entity_id=str(entity_id) if entity_id else None,
+                details=details or {},
+            )
+        )
+        await db.flush()
+    except Exception:  # noqa: BLE001 — audit must never break the caller
+        logger.exception("failed to write audit_log row (%s/%s)", action, entity)

backend/app/utils/ratelimit.py

@@ -0,0 +1,11 @@
+"""Shared rate limiter (slowapi) — in-memory, single-worker friendly.
+
+Login brute-force brake: the edge (Traefik) has a coarse per-IP limit for
+the whole API host; this adds a tight limit on the credential endpoint
+itself. Kept in its own module so routers can import it without a circular
+import on app.main.
+"""
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+limiter = Limiter(key_func=get_remote_address)

backend/app/utils/security.py

@@ -1,14 +1,33 @@
-"""Placeholder auth: no middleware logic, only a header read for `actor` attribution."""
+"""Attribution for quote_events.actor — the VERIFIED user, not the raw token.
+
+Historically this stored the bearer token string verbatim (unverifiable and
+a token leak into the database). All routes that use it now sit behind the
+global JWT dependency, so the token is resolved to the authenticated user
+and the display name is recorded instead.
+"""
 from fastapi import Request
 
+from app.auth import get_optional_user
 
-def get_actor(request: Request) -> str | None:
-    """Extract the bearer token (if any) to attribute quote_events.actor.
 
-    This is the reserved placeholder from the contract — no authentication
-    or authorization is enforced yet.
+async def get_actor(request: Request) -> str | None:
+    """Resolve the caller's display name from the Casdoor Bearer token.
+
+    Uses its own session (get_optional_user default) — same reason as
+    get_current_user: quote routers open explicit db.begin() blocks.
     """
-    auth = request.headers.get("Authorization")
-    if auth and auth.lower().startswith("bearer "):
-        return auth[7:].strip() or None
-    return None
+    ctx = await get_optional_user(request)
+    if ctx is not None:
+        return ctx.display_name
+    # Dev-mode header fallback (only active when DEV_LOGIN_ENABLED) carries
+    # the name in X-User-Name / X-User-Name-B64 — keep attribution useful.
+    name = request.headers.get("x-user-name")
+    import base64
+
+    b64 = request.headers.get("x-user-name-b64")
+    if b64:
+        try:
+            name = base64.b64decode(b64.encode()).decode("utf-8")
+        except Exception:
+            pass
+    return name

backend/requirements.txt

@@ -10,3 +10,13 @@ minio>=7.2.0
 # v2.6 — Casdoor JWT auth
 pyjwt[crypto]>=2.8.0
 httpx>=0.27.0
+
+# Casdoor seeding — bcrypt password hashes (never plaintext)
+bcrypt>=4.1.0
+
+# Observability — metrics + Sentry/GlitchTip exception capture
+prometheus-fastapi-instrumentator>=7.0.0
+sentry-sdk[fastapi]>=2.0.0
+
+# Rate limiting (login brute-force brake; edge limit lives in Traefik)
+slowapi>=0.1.9

backend/tools/seed_casdoor.py

@@ -20,22 +20,34 @@ import json
 import os
 import urllib.request
 
+import bcrypt
+
 BASE = os.environ.get("CASDOOR_BASE", "http://localhost:8080")
 ADMIN = os.environ.get("CASDOOR_ADMIN", "admin")
+# Casdoor's own bootstrap default for the built-in console admin is "123" —
+# the seeder LOGS IN with it (it cannot change the console password).
+# Override with CASDOOR_ADMIN_PW after rotating (docs/SECRET-MANAGEMENT.md);
+# production MUST set a real value here once the console password is rotated.
 ADMIN_PW = os.environ.get("CASDOOR_ADMIN_PW", "123")
 
 ORG = "inventory"
 APP = "inventory-app"
 CLIENT_ID = "inventory-app-client"
-CLIENT_SECRET = "inventory-app-secret-2026"
+# Must MATCH the API's PROCUREMENT_CASDOOR_CLIENT_SECRET (compose default
+# below) — changing one without the other breaks POST /auth/login.
+CLIENT_SECRET = os.environ.get("CASDOOR_CLIENT_SECRET", "inventory-app-secret-2026")
 REDIRECT_URI = "http://localhost/login"  # Traefik edge (v1.3); unused by the in-page flow
 
+# One password for all seeded dev users — override with CASDOOR_SEED_PASSWORD;
+# stored as a bcrypt hash (passwordType "bcrypt"), never plaintext.
+SEED_PASSWORD = os.environ.get("CASDOOR_SEED_PASSWORD", "123456")
+
 USERS = [
-    # (name, first_name, last_name, email, password)
-    ("razaei", "آقای", "رضایی", "razaei@sample.ir", "123456"),
-    ("mousavi", "آقای", "موسوی", "mousavi@sample.ir", "123456"),
-    ("mohaghegh", "آقای", "محقق", "mohaghegh@sample.ir", "123456"),
-    ("tester", "کاربر", "تست", "tester@sample.ir", "123456"),
+    # (name, first_name, last_name, email)
+    ("razaei", "آقای", "رضایی", "razaei@sample.ir"),
+    ("mousavi", "آقای", "موسوی", "mousavi@sample.ir"),
+    ("mohaghegh", "آقای", "محقق", "mohaghegh@sample.ir"),
+    ("tester", "کاربر", "تست", "tester@sample.ir"),
 ]
 
 
@@ -69,17 +81,21 @@ def _login():
     return jar
 
 
+def _bcrypt(pw: str) -> str:
+    return bcrypt.hashpw(pw.encode("utf-8"), bcrypt.gensalt()).decode("ascii")
+
+
 def main():
     cookies = _login()
     if cookies is None:
         return
 
-    # 1) organization (passwordType "plain" = dev: passwords stored as-is)
+    # 1) organization (bcrypt — passwords are never stored plaintext)
     status, body = _request("POST", "/api/add-organization", {
         "owner": "admin",
         "name": ORG,
         "displayName": "سازمان تدارکات",
-        "passwordType": "plain",
+        "passwordType": "bcrypt",
     }, cookies)
     print("add-organization:", status, body.get("msg", body.get("error", "")))
 
@@ -102,7 +118,8 @@ def main():
     print("add-application:", status, body.get("msg", body.get("error", "")))
 
     # 3) users (roles are NOT stored here — they live in the app's users table)
-    for name, first, last, email, pw in USERS:
+    pw_hash = _bcrypt(SEED_PASSWORD)
+    for name, first, last, email in USERS:
         status, body = _request("POST", "/api/add-user", {
             "owner": ORG,
             "name": name,
@@ -110,21 +127,23 @@ def main():
             "firstName": first,
             "lastName": last,
             "email": email,
-            "password": pw,
-            "passwordType": "plain",
+            "password": pw_hash,
+            "passwordType": "bcrypt",
             "phone": "",
             "type": "normal-user",
         }, cookies)
         print(f"add-user {name}:", status, body.get("msg", body.get("error", "")))
         # Ensure passwordType even for already-existing users (this Casdoor
         # version refuses login when both user and org passwordType are empty).
-        status, body = _request("POST", f"/api/update-user?id={ORG}/{name}&columns=password_type", {
-            "passwordType": "plain",
+        status, body = _request("POST", f"/api/update-user?id={ORG}/{name}&columns=password_type,password", {
+            "passwordType": "bcrypt",
+            "password": pw_hash,
         }, cookies)
         print(f"set-password-type {name}:", status, body.get("msg", body.get("error", "")))
 
-    print("\nDone. Casdoor console: http://localhost:8080 (admin/123)")
-    print("Login in the app: http://localhost:3000/login")
+    print("\nDone. Casdoor console: http://localhost:8080")
+    print(f"Seeded users password: {SEED_PASSWORD} (change via CASDOOR_SEED_PASSWORD)")
+    print("Login in the app: http://localhost/login")
 
 
 if __name__ == "__main__":

backend/tools/smoke_test.py

@@ -1,9 +1,14 @@
 """End-to-end smoke tests against a running server (http://127.0.0.1:8000).
 
-Run:  .venv/Scripts/python.exe tools/smoke_test.py
+Dataset-independent: assertions verify BEHAVIOR (status codes, envelopes,
+shapes, filtering) rather than exact seed counts, so the suite works with
+any seed version. Run from the api container or a host with access:
+
+Run:  python tools/smoke_test.py
+Env:  SMOKE_USER / SMOKE_PASSWORD (default tester / 123456 — seeded users)
 """
+import os
 import sys
-from pprint import pprint
 
 import httpx
 
@@ -23,84 +28,150 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- catalog ----------
 r = c.get("/units", params={"page_size": 5})
-check("GET /units", r.status_code == 200 and len(r.json()["data"]) == 5 and "si_factor" in r.json()["data"][0])
+units = r.json()["data"] if r.status_code == 200 else []
+check("GET /units", r.status_code == 200 and len(units) == 5 and "si_factor" in units[0])
 
-r = c.get("/units", params={"dimension": "mass"})
-check("GET /units?dimension=mass", r.status_code == 200 and r.json()["meta"]["total"] == 3)
+if units:
+    dim = units[0]["dimension"]
+    r = c.get("/units", params={"dimension": dim, "page_size": 100})
+    body = r.json()
+    check(
+        "GET /units?dimension filter",
+        r.status_code == 200 and body["meta"]["total"] >= 1
+        and all(u["dimension"] == dim for u in body["data"]),
+        r.text[:200],
+    )
 
 r = c.get("/brands")
-check("GET /brands", r.status_code == 200 and r.json()["meta"]["total"] == 10)
+brands = r.json()["data"] if r.status_code == 200 else []
+check("GET /brands", r.status_code == 200 and brands and r.json()["meta"]["total"] >= 1)
 
-r = c.get("/material-categories", params={"q": "سیمان"})
-check("GET /material-categories?q", r.status_code == 200 and r.json()["meta"]["total"] >= 1)
-
-r = c.get("/materials", params={"q": "میلگرد A3 سایز ۱۴"})
-check("GET /materials?q (unicode)", r.status_code == 200 and r.json()["meta"]["total"] == 1, r.text[:200])
-
-r = c.get("/materials", params={"expand": "category,brands,canonical_unit,attributes", "q": "میلگرد A3 سایز ۱۴"})
-if r.status_code == 200 and r.json()["data"]:
-    m = r.json()["data"][0]
+# category q-search (only when categories exist)
+r = c.get("/material-categories", params={"page_size": 100})
+cats = r.json()["data"] if r.status_code == 200 else []
+check("GET /material-categories", r.status_code == 200 and isinstance(cats, list))
+if cats:
+    needle = cats[0]["name"][:3]
+    r = c.get("/material-categories", params={"q": needle})
     check(
-        "GET /materials expand",
-        "category" in m and "brands" in m and "canonical_unit" in m and "attributes" in m,
+        "GET /material-categories?q (unicode search)",
+        r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200],
     )
-    check("expand category shape", m["category"].keys() == {"id", "slug", "name"})
-    check("expand brands has catalog_code+is_active", all(set(b) >= {"id", "name", "catalog_code", "is_active"} for b in m["brands"]))
-    check("expand canonical_unit shape", m["canonical_unit"].keys() == {"id", "code", "name_fa"})
-    check("expand attributes EAV flattened", all(set(a) >= {"attribute_key", "label", "data_type", "value", "unit"} for a in m["attributes"]))
+
+# materials: q-search against a REAL seeded name (fetched, not hard-coded)
+r = c.get("/materials", params={"page_size": 100})
+materials = r.json()["data"] if r.status_code == 200 else []
+check("GET /materials", r.status_code == 200 and materials and r.json()["meta"]["total"] >= 1)
+
+if materials:
+    target = materials[0]
+    needle = target["name"].split()[0]
+    r = c.get("/materials", params={"q": needle})
+    check(
+        "GET /materials?q (unicode search)",
+        r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200],
+    )
+
+    r = c.get("/materials", params={"expand": "category,brands,canonical_unit,attributes", "q": needle})
+    expanded = [m for m in r.json().get("data", []) if m["id"] == target["id"]]
+    if r.status_code == 200 and expanded:
+        m = expanded[0]
+        check(
+            "GET /materials expand",
+            "category" in m and "brands" in m and "canonical_unit" in m and "attributes" in m,
+        )
+        check("expand category shape", m["category"].keys() == {"id", "slug", "name"})
+        check("expand brands shape", all(set(b) >= {"id", "name", "catalog_code", "is_active"} for b in m["brands"]))
+        check("expand canonical_unit shape", m["canonical_unit"].keys() == {"id", "code", "name_fa"})
+        check("expand attributes EAV flattened", all(set(a) >= {"attribute_key", "label", "data_type", "value", "unit"} for a in m["attributes"]))
+    else:
+        check("GET /materials expand", False, r.text[:300])
+
+# ---------- EAV filters (positive filter only when the seed has values) ----------
+r = c.get("/attribute-definitions", params={"page_size": 100})
+attr_defs = r.json()["data"] if r.status_code == 200 else []
+
+if attr_defs and materials:
+    r = c.get("/materials", params={"expand": "attributes", "page_size": 100})
+    with_attrs = [m for m in r.json().get("data", []) if m.get("attributes")]
+    if with_attrs:
+        m0 = with_attrs[0]
+        key = m0["attributes"][0]["attribute_key"]
+        value = str(m0["attributes"][0]["value"])
+        r = c.get("/materials", params={f"attr_{key}": value, "expand": "attributes"})
+        check(
+            f"GET /materials?attr_{key} filter",
+            r.status_code == 200 and any(x["id"] == m0["id"] for x in r.json().get("data", [])),
+            r.text[:200],
+        )
+    else:
+        print("  SKIP  EAV positive filter — seed defines no material attribute values")
 else:
-    check("GET /materials expand", False, r.text[:300])
+    print("  SKIP  EAV positive filter — seed defines no attribute definitions")
 
-# dynamic EAV filter: attr_rebar_diameter=14
-r = c.get("/materials", params={"attr_rebar_diameter": "14", "expand": "attributes"})
-if r.status_code == 200:
-    data = r.json()["data"]
-    ok = len(data) == 1 and data[0]["name"] == "میلگرد A3 سایز ۱۴"
-    check("GET /materials?attr_rebar_diameter=14", ok, r.text[:200])
-else:
-    check("GET /materials?attr_rebar_diameter=14", False, r.text[:200])
-
-# EAV boolean filter: attr_rebar_ribbed=true
-r = c.get("/materials", params={"attr_rebar_ribbed": "true"})
-check("GET /materials?attr_rebar_ribbed=true", r.status_code == 200 and r.json()["meta"]["total"] == 1, r.text[:200])
-
-# brand filter
-r = c.get("/brands", params={"q": "فولاد مبارکه"})
-brand_id = r.json()["data"][0]["id"]
-r = c.get("/materials", params={"brand_id": brand_id})
-check("GET /materials?brand_id=", r.status_code == 200 and r.json()["meta"]["total"] == 3, r.text[:200])
-
-# unknown attr filter -> 400
+# unknown attr filter -> 400 (dataset-independent)
 r = c.get("/materials", params={"attr_nonexistent": "1"})
 check("unknown attr filter -> 400", r.status_code == 400 and r.json()["error"]["code"] == "VALIDATION_ERROR")
 
 r = c.get("/materials?page_size=999")
 check("page_size>100 -> 400", r.status_code == 400)
 
+# brand filter via a brand that actually has material links
+r = c.get("/brand-materials", params={"page_size": 100})
+brand_links = r.json()["data"] if r.status_code == 200 else []
+if brand_links:
+    brand_id = brand_links[0]["brand_id"]
+    r = c.get("/materials", params={"brand_id": brand_id})
+    check("GET /materials?brand_id=", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200])
+    r = c.get("/brand-materials", params={"brand_id": brand_id})
+    check("GET /brand-materials?brand_id", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200])
+else:
+    check("GET /materials?brand_id=", False, "seed has no brand-material links")
+
+# ---------- suppliers / projects ----------
 r = c.get("/suppliers")
-check("GET /suppliers", r.status_code == 200 and r.json()["meta"]["total"] == 6)
+suppliers = r.json()["data"] if r.status_code == 200 else []
+check("GET /suppliers", r.status_code == 200 and suppliers)
 
 r = c.get("/projects")
-check("GET /projects", r.status_code == 200 and r.json()["meta"]["total"] == 5)
+projects = r.json()["data"] if r.status_code == 200 else []
+check("GET /projects", r.status_code == 200 and projects)
 
-r = c.get("/attribute-definitions", params={"expand": "unit"})
-check("GET /attribute-definitions", r.status_code == 200 and r.json()["meta"]["total"] == 28, r.text[:200])
+r = c.get("/attribute-definitions")
+attr_shape_ok = r.status_code == 200 and all(
+    set(a) >= {"attribute_key", "label", "data_type"} for a in r.json().get("data", [])
+)
+check("GET /attribute-definitions", attr_shape_ok, r.text[:200])
 
-r = c.get("/material-categories/{cid}/attributes".format(cid=c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]["id"]))
-check("GET category attributes (nested attribute)", r.status_code == 200 and len(r.json()["data"]) == 3 and "attribute" in r.json()["data"][0])
-
-r = c.get("/brand-materials", params={"brand_id": brand_id})
-check("GET /brand-materials?brand_id", r.status_code == 200 and r.json()["meta"]["total"] == 3)
+if cats:
+    r = c.get(f"/material-categories/{cats[0]['id']}/attributes")
+    check(
+        "GET category attributes (nested)",
+        r.status_code == 200 and isinstance(r.json()["data"], list)
+        and all("attribute" in a for a in r.json()["data"]),
+        r.text[:200],
+    )
 
 # ---------- quotes ----------
 r = c.get("/quotes", params={"page_size": 5})
-check("GET /quotes", r.status_code == 200 and r.json()["meta"]["total"] == 7, r.text[:300])
+quotes = r.json()["data"] if r.status_code == 200 else []
+check("GET /quotes", r.status_code == 200 and quotes and r.json()["meta"]["total"] >= 1)
 
-r = c.get("/quotes", params={"expand": "line_items,termsheets,events,supplier,project", "status": "accepted"})
-if r.status_code == 200 and r.json()["data"]:
-    q = r.json()["data"][0]
+r = c.get("/quotes", params={"expand": "line_items,termsheets,events,supplier,project"})
+accepted = [q for q in r.json().get("data", []) if q.get("line_items")] if r.status_code == 200 else []
+if accepted:
+    q = accepted[0]
     li = q["line_items"][0]
     check(
         "GET /quotes expand full shape",
@@ -111,21 +182,34 @@ if r.status_code == 200 and r.json()["data"]:
         r.text[:400],
     )
     check("events sorted ASC", [e["event_type"] for e in q["events"]] == sorted([e["event_type"] for e in q["events"]]))
-    check("termsheet has schedule_steps", "schedule_steps" in q["termsheets"][0])
+    if q["termsheets"]:
+        check("termsheet has schedule_steps", "schedule_steps" in q["termsheets"][0])
 else:
     check("GET /quotes expand full shape", False, r.text[:400])
 
 r = c.get("/quotes/stats")
-check("GET /quotes/stats", r.status_code == 200 and r.json()["data"]["total"] == 7 and "average_lead_time_days" in r.json()["data"], r.text[:300])
+stats_ok = r.status_code == 200 and "average_lead_time_days" in r.json()["data"]
+if quotes:
+    stats_ok = stats_ok and r.json()["data"]["total"] == r.json()["data"]["offered"] + \
+        r.json()["data"]["accepted"] + r.json()["data"]["arrived"] + \
+        r.json()["data"]["rejected"] + r.json()["data"]["expired"]
+check("GET /quotes/stats", stats_ok, r.text[:300])
 
 r = c.get("/quotes/stats", params={"status": "offered"})  # status filter not part of stats contract; ensure no crash
 check("GET /quotes/stats (extra param ignored)", r.status_code == 200)
 
-r = c.get("/quotes", params={"q": "میلگرد"})
-check("GET /quotes?q (searches material names)", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:300])
+if materials:
+    needle = materials[0]["name"].split()[0]
+    r = c.get("/quotes", params={"q": needle})
+    check("GET /quotes?q (searches material names)", r.status_code == 200, r.text[:300])
 
-r = c.get("/projects/{pid}/stats".format(pid=c.get("/projects", params={"q": "ونوس"}).json()["data"][0]["id"]))
-check("GET /projects/{id}/stats", r.status_code == 200 and set(r.json()["data"]) >= {"total_quotes", "offered", "accepted", "arrived", "rejected", "expired"}, r.text[:300])
+if projects:
+    r = c.get(f"/projects/{projects[0]['id']}/stats")
+    check(
+        "GET /projects/{id}/stats",
+        r.status_code == 200 and set(r.json()["data"]) >= {"total_quotes", "offered", "accepted", "arrived", "rejected", "expired"},
+        r.text[:300],
+    )
 
 print(f"\n===== {PASS} passed, {FAIL} failed =====")
 sys.exit(1 if FAIL else 0)

backend/tools/smoke_test_misc.py

@@ -19,9 +19,20 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+import os
+
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- units ----------
 r = c.post("/units", json={"code": "test-unit", "name_fa": "واحد تست", "dimension": "count", "si_factor": 1.0})
-check("POST /units", r.status_code == 201 and r.json()["data"]["id"] > 19, r.text[:200])
+check("POST /units", r.status_code == 201 and r.json()["data"]["si_factor"] == 1.0, r.text[:200])
 uid = r.json()["data"]["id"]
 r = c.post("/units", json={"code": "test-unit", "si_factor": 1.0})
 check("POST /units duplicate code -> 409", r.status_code == 409, r.text[:200])
@@ -42,21 +53,28 @@ r = c.patch(f"/brands/{bid}", json={"name": "برند تست ۲"})
 check("PATCH /brands", r.status_code == 200 and r.json()["data"]["name"] == "برند تست ۲")
 r = c.delete(f"/brands/{bid}")
 check("DELETE /brands (unused)", r.status_code == 200)
-r = c.get("/brands", params={"q": "فولاد مبارکه"})
-brand = r.json()["data"][0]
+_bml = c.get("/brand-materials", params={"page_size": 1}).json()["data"]
+if _bml:
+    brand = {"id": _bml[0]["brand_id"]}
+else:
+    brand = c.get("/brands", params={"page_size": 1}).json()["data"][0]
 r = c.delete(f"/brands/{brand['id']}")
 check("DELETE /brands with associations -> 409", r.status_code == 409, r.text[:200])
 
 # ---------- categories ----------
 r = c.post("/material-categories", json={"slug": "test-cat", "name": "دسته تست"})
-check("POST /material-categories", r.status_code == 201, r.text[:200])
-cid = r.json()["data"]["id"]
+if r.status_code == 409:  # rerun safety — fetch the existing test category
+    cid = c.get("/material-categories", params={"q": "test-cat"}).json()["data"][0]["id"]
+    check("POST /material-categories (exists from previous run)", True)
+else:
+    check("POST /material-categories", r.status_code == 201, r.text[:200])
+    cid = r.json()["data"]["id"]
 r = c.patch(f"/material-categories/{cid}", json={"name": "دسته تست ۲", "is_active": False})
 check("PATCH /material-categories", r.status_code == 200 and r.json()["data"]["is_active"] is False)
 r = c.delete(f"/material-categories/{cid}")
 check("DELETE /material-categories (empty)", r.status_code == 200)
-r = c.get("/material-categories", params={"q": "میلگرد"})
-cat = r.json()["data"][0]
+_mat0 = c.get("/materials", params={"page_size": 1, "expand": "category"}).json()["data"][0]
+cat = _mat0["category"]
 r = c.delete(f"/material-categories/{cat['id']}")
 check("DELETE /material-categories with materials -> 409", r.status_code == 409, r.text[:200])
 
@@ -75,11 +93,16 @@ r = c.patch(f"/attribute-definitions/{adid}", json={"data_type": "number"})
 check("PATCH data_type with no values -> OK", r.status_code == 200 and r.json()["data"]["data_type"] == "number", r.text[:200])
 
 # use a DEDICATED test material so the seed material's EAV values stay intact
-cat = c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]
+# (dataset-independent: any category; rerun reuses the existing test material)
+cat = c.get("/material-categories", params={"page_size": 1}).json()["data"][0]
 unit_kg = c.get("/units", params={"q": "kg"}).json()["data"][0]["id"]
 r = c.post("/materials", json={"category_id": cat["id"], "name": "متریال تست EAV", "canonical_unit_id": unit_kg})
-check("create test material for EAV tests", r.status_code == 201, r.text[:200])
-tmat = r.json()["data"]
+if r.status_code == 409:  # rerun
+    tmat = c.get("/materials", params={"q": "متریال تست EAV"}).json()["data"][0]
+    check("create test material for EAV tests (exists from previous run)", True)
+else:
+    check("create test material for EAV tests", r.status_code == 201, r.text[:200])
+    tmat = r.json()["data"]
 mat = tmat
 r = c.put(f"/materials/{mat['id']}/attribute-values", json={"attributes": [
     {"attribute_definition_id": adid, "value": 5},
@@ -99,7 +122,11 @@ check("DELETE attribute-definition (no values) -> 200", r.status_code == 200, r.
 # ---------- category attributes ----------
 # use a FRESH definition so the pair is not already in the seed junction
 r = c.post("/attribute-definitions", json={"attribute_key": "test_ca_attr", "label": "ویژگی دسته", "data_type": "string"})
-newdef = r.json()["data"]
+if r.status_code == 409:  # rerun safety — fetch the existing definition
+    newdef = next(d for d in c.get("/attribute-definitions", params={"page_size": 100}).json()["data"]
+                  if d["attribute_key"] == "test_ca_attr")
+else:
+    newdef = r.json()["data"]
 r = c.post(f"/material-categories/{cat['id']}/attributes", json={"attribute_definition_id": newdef["id"], "is_required": True, "sort_order": 9})
 check("POST category attribute", r.status_code == 201 and r.json()["data"]["attribute"]["attribute_key"] == "test_ca_attr", r.text[:200])
 r = c.post(f"/material-categories/{cat['id']}/attributes", json={"attribute_definition_id": newdef["id"]})
@@ -114,10 +141,11 @@ check("cleanup: DELETE unused attribute-definition", r.status_code == 200)
 # ---------- material units ----------
 r = c.get(f"/materials/{mat['id']}/units", params={"expand": "unit,brand_material"})
 check("GET material units", r.status_code == 200, r.text[:200])
-r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": 6, "conversion_factor": 0.001, "is_default": False})
+_unit_other = next(u for u in c.get("/units", params={"page_size": 100}).json()["data"] if u["code"] != "kg")
+r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": _unit_other["id"], "conversion_factor": 0.001, "is_default": False})
 check("POST material unit", r.status_code == 201, r.text[:200])
 muid = r.json()["data"]["id"]
-r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": 6, "conversion_factor": 2})
+r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": _unit_other["id"], "conversion_factor": 2})
 check("POST material unit duplicate -> 409", r.status_code == 409, r.text[:200])
 r = c.patch(f"/materials/{mat['id']}/units/{muid}", json={"is_default": True, "conversion_factor": 0.002})
 check("PATCH material unit (is_default)", r.status_code == 200 and r.json()["data"]["is_default"] is True)
@@ -125,10 +153,10 @@ r = c.delete(f"/materials/{mat['id']}/units/{muid}")
 check("DELETE material unit", r.status_code == 200)
 
 # ---------- brand materials ----------
-r = c.get("/materials", params={"q": "سیمان پرتلند تیپ ۲"})
-m2 = r.json()["data"][0]
-r = c.get("/brands", params={"q": "Bosch"})
-b2 = r.json()["data"][0]
+# dataset-independent: any material + a freshly created brand (no existing link)
+m2 = c.get("/materials", params={"page_size": 1}).json()["data"][0]
+r = c.post("/brands", json={"name": "برند لینک تست", "country": "ایران"})
+b2 = r.json()["data"] if r.status_code == 201 else c.get("/brands", params={"q": "برند لینک تست"}).json()["data"][0]
 r = c.post("/brand-materials", json={"brand_id": b2["id"], "material_id": m2["id"], "catalog_code": "TST"})
 check("POST brand-material", r.status_code == 201, r.text[:200])
 bmid = r.json()["data"]["id"]
@@ -140,18 +168,18 @@ r = c.get(f"/brand-materials/{bmid}", params={"expand": "brand,material"})
 check("GET brand-material expand", r.status_code == 200 and "brand" in r.json()["data"] and "material" in r.json()["data"])
 r = c.delete(f"/brand-materials/{bmid}")
 check("DELETE brand-material", r.status_code == 200)
+r = c.delete(f"/brands/{b2['id']}")
+check("cleanup: DELETE link-test brand", r.status_code == 200, r.text[:200])
 
 # ---------- supplier/project patches ----------
-r = c.get("/suppliers", params={"q": "آریا"})
-s1 = r.json()["data"][0]
+s1 = c.get("/suppliers", params={"page_size": 1}).json()["data"][0]
 r = c.patch(f"/suppliers/{s1['id']}", json={"phone": "021-00000000"})
 check("PATCH /suppliers", r.status_code == 200 and r.json()["data"]["phone"] == "021-00000000")
 r = c.patch(f"/suppliers/{s1['id']}", json={"phone": "021-55123456"})
-r = c.get("/projects", params={"q": "ونوس"})
-p1 = r.json()["data"][0]
+p1 = c.get("/projects", params={"page_size": 1}).json()["data"][0]
 r = c.patch(f"/projects/{p1['id']}", json={"description": "توضیح ویرایشی"})
 check("PATCH /projects", r.status_code == 200 and r.json()["data"]["description"] == "توضیح ویرایشی")
-r = c.patch(f"/projects/{p1['id']}", json={"description": "ساختمان ۱۸ طبقه مسکونی در زعفرانیه"})
+r = c.patch(f"/projects/{p1['id']}", json={"description": p1.get("description")})
 
 # ---------- quote PATCH metadata ----------
 r = c.get("/quotes", params={"status": "offered", "page_size": 1})
@@ -166,16 +194,17 @@ r = c.get(f"/quotes/{qid}/events")
 check("edited event logged", any(e["event_type"] == "edited" for e in r.json()["data"]))
 
 # ---------- termsheet delete rules ----------
+# termsheet-count tolerance: this suite needs >=2 termsheets on the picked quote
 r = c.get(f"/quotes/{qid}/termsheets")
 ts = r.json()["data"]
-if len(ts) == 1:
+while len(ts) < 2:
     r = c.post(f"/quotes/{qid}/termsheets", json={"label": "ثانویه", "schedule_steps": [{"due_date": "2026-12-01", "amount": 10}]})
-    check("POST second termsheet", r.status_code == 201, r.text[:200])
-    ts = r.json()["data"]
+    check("POST additional termsheet", r.status_code == 201, r.text[:200])
     ts = c.get(f"/quotes/{qid}/termsheets").json()["data"]
 r = c.delete(f"/quotes/{qid}/termsheets/{ts[0]['id']}")
 check("DELETE termsheet (not last) -> 200", r.status_code == 200, r.text[:200])
-r = c.delete(f"/quotes/{qid}/termsheets/{ts[1]['id']}")
+_remaining = c.get(f"/quotes/{qid}/termsheets").json()["data"]
+r = c.delete(f"/quotes/{qid}/termsheets/{_remaining[-1]['id']}")
 check("DELETE last termsheet -> 409", r.status_code == 409, r.text[:200])
 # restore a second termsheet for later tests
 r = c.post(f"/quotes/{qid}/termsheets", json={"label": "ثانویه ۲", "schedule_steps": [{"due_date": "2026-12-01", "amount": 10}]})
@@ -192,31 +221,52 @@ if len(steps) > 1:
 r = c.delete(f"/quotes/{qid}/termsheets/{ts0['id']}/schedule-steps/{steps[-1]['id']}")
 check("DELETE last schedule-step -> 409", r.status_code == 409, r.text[:200])
 
-# ---------- decision rules (on a pending quote) ----------
-r = c.get(f"/quotes/{qid}/line-items")
-li = r.json()["data"][0]
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "chosen", "chosen_item_termsheet_id": "00000000-0000-0000-0000-000000000000"})
-check("PUT decision chosen with foreign link -> 400", r.status_code == 400, r.text[:200])
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "rejected"})
-check("PUT decision rejected", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "chosen"})
-check("PUT decision rejected->chosen -> 409", r.status_code == 409, r.text[:200])
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/decision/status", json={"status": "pending"})
-# pending is NOT an accepted payload value — the endpoint only transitions to chosen/rejected
-check("PATCH decision status to pending -> 400", r.status_code == 400, r.text[:200])
+# ---------- decision rules (need a PENDING decision — rerun-safe pick) ----------
+_pending = None
+for _qo in c.get("/quotes", params={"status": "offered", "page_size": 20, "expand": "line_items"}).json()["data"]:
+    for _lix in _qo["line_items"]:
+        if _lix.get("decision") and _lix["decision"]["status"] == "pending":
+            _pending = (_qo["id"], _lix)
+            break
+    if _pending:
+        break
+if _pending:
+    _qid2, li = _pending
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "chosen", "chosen_item_termsheet_id": "00000000-0000-0000-0000-000000000000"})
+    check("PUT decision chosen with foreign link -> 400", r.status_code == 400, r.text[:200])
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "rejected"})
+    check("PUT decision rejected", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "chosen"})
+    check("PUT decision rejected->chosen -> 409", r.status_code == 409, r.text[:200])
+    r = c.patch(f"/quotes/{_qid2}/line-items/{li['id']}/decision/status", json={"status": "pending"})
+    # pending is NOT an accepted payload value — the endpoint only transitions to chosen/rejected
+    check("PATCH decision status to pending -> 400", r.status_code == 400, r.text[:200])
+else:
+    print("  SKIP  decision rules — no offered quote with a pending decision")
 
 # ---------- item termsheets ----------
-r = c.get(f"/quotes/{qid}/line-items/{li['id']}/termsheets")
-its = r.json()["data"]
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": 9999})
-check("PATCH item-termsheet", r.status_code == 200 and r.json()["data"]["unit_price"] == 9999.0, r.text[:200])
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": its[0]["unit_price"]})
+# termsheet-count tolerance marker
+if _pending:
+    _its_quote, li = _pending
+    r = c.get(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets")
+    its = r.json().get("data", [])
+    if its:
+        r = c.patch(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": 9999})
+        check("PATCH item-termsheet", r.status_code == 200 and r.json()["data"]["unit_price"] == 9999.0, r.text[:200])
+        r = c.patch(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": its[0]["unit_price"]})
+    else:
+        print("  SKIP  PATCH item-termsheet — picked line item has no item pricing rows")
+else:
+    print("  SKIP  PATCH item-termsheet — no pending decision available")
 
 # ---------- invoice upload on accepted/arrived (multi-file) ----------
 r = c.get("/quotes", params={"status": "arrived", "page_size": 1})
 arrived = r.json()["data"]
 if arrived:
     qa = arrived[0]
+    # rerun safety — remove invoices left by previous runs
+    for _inv in c.get(f"/quotes/{qa['id']}/invoice").json()["data"]:
+        c.delete(f"/quotes/{qa['id']}/invoice/{_inv['id']}")
     files = {"file": ("inv.pdf", b"%PDF-1.4 invoice", "application/pdf")}
     r = c.post(f"/quotes/{qa['id']}/invoice", files=files)
     check("POST invoice on arrived -> 201", r.status_code == 201 and r.json()["data"]["mime_type"] == "application/pdf", r.text[:200])

backend/tools/smoke_test_write.py

@@ -23,16 +23,45 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+import os
+
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- supplier + project for the test quote ----------
-sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران"}).json()["data"]
-proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"}).json()["data"]
-check("POST /suppliers + /projects", True)
+# dataset-independent: fetch/create whatever the seed does or doesn't have
+cat = c.get("/material-categories", params={"page_size": 1}).json()["data"][0]
+r_sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران", "category_id": cat["id"]})
+if r_sup.status_code == 201:
+    sup = r_sup.json()["data"]
+    check("POST /suppliers", True)
+else:  # rerun — the test supplier already exists
+    sup = c.get("/suppliers", params={"q": "تأمین‌کننده تست"}).json()["data"][0]
+    check("POST /suppliers (exists from previous run — 409 tolerated)", r_sup.status_code == 409, r_sup.text[:200])
+r_proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"})
+if r_proj.status_code == 201:
+    proj = r_proj.json()["data"]
+    check("POST /projects", True)
+else:
+    proj = c.get("/projects", params={"q": "پروژه تست"}).json()["data"][0]
+    check("POST /projects (exists from previous run — 409 tolerated)", r_proj.status_code == 409, r_proj.text[:200])
 
 # ---------- material with EAV + brands ----------
-cat = c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]
 unit_kg = c.get("/units", params={"q": "kg"}).json()["data"][0]["id"]
-brand = c.get("/brands", params={"q": "فولاد مبارکه"}).json()["data"][0]
+brand = c.get("/brands", params={"page_size": 1}).json()["data"][0]
 defs = {d["attribute_key"]: d for d in c.get("/attribute-definitions", params={"page_size": 100}).json()["data"]}
+# ensure the EAV keys this suite exercises exist (seed-independent)
+for _key, _dt in (("rebar_grade", "string"), ("rebar_diameter", "number"), ("rebar_ribbed", "boolean")):
+    if _key not in defs:
+        r = c.post("/attribute-definitions", json={"attribute_key": _key, "label": _key, "data_type": _dt})
+        check("POST /attribute-definitions (%s)" % _key, r.status_code == 201, r.text[:200])
+        defs[_key] = r.json()["data"]
 
 r = c.post(
     "/materials",
@@ -48,11 +77,15 @@ r = c.post(
         ],
     },
 )
-check("POST /materials (EAV+brands)", r.status_code == 201, r.text[:300])
-material = r.json()["data"]
+if r.status_code == 201:
+    material = r.json()["data"]
+    check("POST /materials (EAV+brands)", True)
+else:  # rerun — fetch the material a previous run created
+    material = c.get("/materials", params={"q": "میلگرد تست A3 سایز ۱۶"}).json()["data"][0]
+    check("POST /materials (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])
 
 r = c.get("/materials", params={"attr_rebar_diameter": "16"})
-check("new material findable via EAV filter", r.status_code == 200 and r.json()["meta"]["total"] == 1)
+check("new material findable via EAV filter", r.status_code == 200 and any(m["id"] == material["id"] for m in r.json()["data"]))
 
 r = c.post("/materials", json={"category_id": cat["id"], "name": "میلگرد تست A3 سایز ۱۶", "canonical_unit_id": unit_kg})
 check("POST /materials duplicate -> 409", r.status_code == 409 and r.json()["error"]["code"] == "CONFLICT", r.text[:200])
@@ -68,21 +101,32 @@ r = c.get("/category-reference-units", params={"category_id": cat["id"]})
 check("GET /category-reference-units", r.status_code == 200 and r.json()["data"][0]["ref_unit"] == "کیلوگرم")
 
 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
-check("POST /unit-conversions", r.status_code == 201, r.text[:200])
-uc = r.json()["data"]
+if r.status_code == 409:  # rerun — reuse the existing conversion
+    uc = next(x for x in c.get("/unit-conversions", params={"page_size": 100}).json()["data"]
+              if x["from_unit"] == "کیلوگرم" and x["to_unit"] == "متر" and x["category"]["id"] == cat["id"])
+    check("POST /unit-conversions (exists from previous run — 409 tolerated)", True)
+else:
+    check("POST /unit-conversions", r.status_code == 201, r.text[:200])
+    uc = r.json()["data"]
 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
 check("POST /unit-conversions duplicate -> 409", r.status_code == 409, r.text[:200])
 r = c.patch(f"/unit-conversions/{uc['id']}", json={"factor": 9.5})
 check("PATCH /unit-conversions", r.status_code == 200 and r.json()["data"]["factor"] == 9.5)
 
 r = c.post("/standard-conversions", json={"from_unit": "تن", "to_unit": "کیلوگرم", "factor": 1000})
-check("POST /standard-conversions", r.status_code == 201, r.text[:200])
-sc_id = r.json()["data"]["id"]
+if r.status_code == 201:
+    sc_id = r.json()["data"]["id"]
+    check("POST /standard-conversions", True)
+else:  # rerun — reuse the existing conversion
+    sc_id = next(x["id"] for x in c.get("/standard-conversions", params={"page_size": 100}).json()["data"]
+                 if x["from_unit"] == "تن" and x["to_unit"] == "کیلوگرم")
+    check("POST /standard-conversions (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])
 r = c.get("/standard-conversions")
 check("GET /standard-conversions", r.status_code == 200 and r.json()["meta"]["total"] >= 1)
 
 # ---------- nested quote creation ----------
-material2 = c.get("/materials", params={"q": "میلگرد A3 سایز ۱۴"}).json()["data"][0]
+_all_materials = c.get("/materials", params={"page_size": 100}).json()["data"]
+material2 = next(m for m in _all_materials if m["id"] != material["id"])
 r = c.post(
     "/quotes",
     json={
@@ -125,7 +169,11 @@ check("DELETE /quotes offered -> OK", r.status_code == 200 and r.json()["data"][
 r = c.post("/quotes", json={"supplier_id": sup["id"],
                             "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
                             "termsheets": [], "item_termsheets": []})
-check("POST /quotes empty termsheets -> 400", r.status_code == 400 and r.json()["error"]["field"] == "termsheets")
+# current contract: termsheets are optional at quote level (item pricing
+# is driven by item_termsheets) — a quote without them is valid
+check("POST /quotes empty termsheets -> 201 (optional since v2.6)", r.status_code == 201, r.text[:200])
+if r.status_code == 201:
+    c.delete(f"/quotes/{r.json()['data']['id']}")
 
 r = c.post("/quotes", json={"supplier_id": sup["id"],
                             "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
@@ -233,33 +281,49 @@ check("GET receipt of rejected item -> 404", r.status_code == 404)
 r = c.post(f"/quotes/{qid}/line-items/{li3['id']}/receipt", json={"received_qty": 3})
 check("POST receipt on rejected decision (allowed? decision exists)", r.status_code in (201, 409), r.text[:200])
 
-# ---------- backward transition ----------
+# ---------- backward transition (v2.6 rule: quotes WITH inventory receipts
+# are immutable — they feed the stock ledger) ----------
 r = c.patch(f"/quotes/{qid}", json={"status": "offered", "notes": "بازگشت برای اصلاح"})
-check("PATCH backward accepted->offered", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+check(
+    "PATCH backward accepted->offered blocked after receipts",
+    r.status_code == 409 and "رسید" in r.json()["error"]["message"], r.text[:300],
+)
 r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
 decisions = [li["decision"]["status"] for li in r.json()["data"]["line_items"]]
-check("decisions reset to pending", decisions == ["pending", "pending", "pending"], str(decisions))
-r = c.get(f"/quotes/{qid}/termsheets")
+check("decisions unchanged after blocked revert", decisions == ["chosen", "chosen", "rejected"], str(decisions))
+
+# transition tests need a quote WITHOUT receipts — q3:
+q3 = c.post("/quotes", json={
+    "supplier_id": sup["id"], "project_id": proj["id"],
+    "quote_date": "2026-08-02T10:00:00Z", "expiry_date": "2026-08-20",
+    "line_items": [{"temp_id": "li-x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 2}],
+    "termsheets": [{"temp_id": "ts-x", "label": "نقدی", "schedule_steps": [{"due_date": "2026-08-10", "amount": 5000}]}],
+    "item_termsheets": [{"line_item_temp_id": "li-x", "termsheet_temp_id": "ts-x", "unit_price": 2500}],
+}).json()["data"]
+r = c.patch(f"/quotes/{q3['id']}/accept", json={
+    "accepted_termsheets": [{"id": q3["termsheets"][0]["id"],
+                             "schedule_steps": [{"step_no": 1, "due_date": "2026-08-10", "amount": 5000}]}],
+    "item_decisions": [{"line_item_id": q3["line_items"][0]["id"], "status": "chosen", "accepted_termsheet_index": 0, "adjusted_unit_price": 2500}],
+})
+check("q3 accept", r.status_code == 200, r.text[:300])
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
+check("PATCH backward accepted->offered (no receipts) -> OK", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+r = c.get(f"/quotes/{q3['id']}", params={"expand": "line_items"})
+check("decisions reset to pending", [li["decision"]["status"] for li in r.json()["data"]["line_items"]] == ["pending"], r.text[:200])
+r = c.get(f"/quotes/{q3['id']}/termsheets")
 check("termsheets demoted to offered", all(t["status"] == "offered" for t in r.json()["data"]), r.text[:200])
-r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
-receipts_kept = all(li.get("receipt") is not None for li in r.json()["data"]["line_items"] if li["decision"])
-check("item_receipts NOT deleted on revert", receipts_kept, r.text[:200])
-
-r = c.patch(f"/quotes/{qid}", json={"status": "accepted"})
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "accepted"})
 check("forward offered->accepted via PATCH -> 409", r.status_code == 409, r.text[:200])
-
-# ---------- reject / expire ----------
-r = c.patch(f"/quotes/{qid}/reject", json={"reason": "قیمت بالا"})
+r = c.patch(f"/quotes/{q3['id']}/reject", json={"reason": "قیمت بالا"})
 check("PATCH reject", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
-r = c.get(f"/quotes/{qid}/events")
+r = c.get(f"/quotes/{q3['id']}/events")
 check("reject reason in event payload", any(e["event_type"] == "rejected" and e["payload"].get("reason") == "قیمت بالا" for e in r.json()["data"]))
-
-r = c.patch(f"/quotes/{qid}", json={"status": "offered"})
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
 check("rejected->offered reopen", r.status_code == 200 and r.json()["data"]["status"] == "offered", r.text[:200])
-r = c.patch(f"/quotes/{qid}/expire")
+r = c.patch(f"/quotes/{q3['id']}/expire")
 check("PATCH expire", r.status_code == 200 and r.json()["data"]["status"] == "expired", r.text[:200])
-r = c.delete(f"/quotes/{qid}")
-check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 3, r.text[:300])
+r = c.delete(f"/quotes/{q3['id']}")
+check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 1, r.text[:300])
 
 # ---------- files ----------
 q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
@@ -269,8 +333,13 @@ q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
 files = {"file": ("proforma.pdf", b"%PDF-1.4 test", "application/pdf")}
 r = c.post(f"/quotes/{q2['id']}/proforma", files=files)
 check("POST proforma (any status)", r.status_code == 201 and r.json()["data"]["file_name"] == "proforma.pdf", r.text[:200])
+# current contract: attachments are allowed in EVERY status (files.py) —
+# the invoice can be attached from the edit page at any time
 r = c.post(f"/quotes/{q2['id']}/invoice", files=files)
-check("POST invoice on offered -> 409", r.status_code == 409, r.text[:200])
+check("POST invoice on offered (any-status contract)", r.status_code == 201, r.text[:200])
+inv_id = r.json()["data"]["id"]
+r = c.delete(f"/quotes/{q2['id']}/invoice/{inv_id}")
+check("DELETE test invoice", r.status_code == 200, r.text[:200])
 r = c.get(f"/quotes/{q2['id']}/proforma")
 lst = r.json()["data"]
 check("GET proforma list has 1", r.status_code == 200 and len(lst) == 1, r.text[:200])
@@ -282,8 +351,8 @@ check("DELETE proforma by id", r.status_code == 200 and r.json()["data"]["delete
 r = c.get(f"/quotes/{q2['id']}/proforma")
 check("GET proforma list empty after delete", r.status_code == 200 and r.json()["data"] == [], r.text[:200])
 
-# cleanup test material + supplier + project
-# q2 still references supplier/project/material -> all deletes must be blocked
+# ---------- cleanup ----------
+# q2 (offered) is deletable; qid is a receipts-protected artifact that stays.
 r = c.delete(f"/suppliers/{sup['id']}")
 check("DELETE supplier with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
@@ -291,14 +360,15 @@ check("DELETE project with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/materials/{material['id']}")
 check("DELETE material with line_items -> 409", r.status_code == 409, r.text[:200])
 
-r = c.delete(f"/quotes/{q2['id']}")  # q2 still references the test material
+r = c.delete(f"/quotes/{q2['id']}")
 check("cleanup: DELETE q2 quote", r.status_code == 200, r.text[:200])
+# qid (arrived, receipt-protected) still references everything -> protected
 r = c.delete(f"/materials/{material['id']}")
-check("DELETE material (no line_items refs)", r.status_code == 200, r.text[:200])
+check("DELETE material (still referenced by receipt-protected quote) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/suppliers/{sup['id']}")
-check("DELETE supplier (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE supplier (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
-check("DELETE project (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE project (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/unit-conversions/{uc['id']}")
 check("DELETE unit-conversion", r.status_code == 200)
 r = c.delete(f"/standard-conversions/{sc_id}")

backups/restore.ps1

@@ -1,44 +0,0 @@
-# ============================================================
-# Restore the committed demo-state dumps (backups/*.dump) into
-# the running stack. REPLACES all data in the `procurement` and
-# `casdoor` databases — run it on a fresh boot or when you want
-# to reset to the exact committed state.
-#
-#   powershell -ExecutionPolicy Bypass -File .\backups\restore.ps1
-# ============================================================
-
-$ErrorActionPreference = "Stop"
-$here = Split-Path -Parent $MyInvocation.MyCommand.Path
-Set-Location (Join-Path $here "..")
-
-Write-Host ""
-Write-Host "Restoring demo data — this REPLACES the current DB content!" -ForegroundColor Yellow
-
-docker compose ps postgres | Select-String "healthy" | Out-Null
-if ($LASTEXITCODE -ne 0) {
-    Write-Host "postgres is not healthy — run 'docker compose up -d' first." -ForegroundColor Red
-    exit 1
-}
-
-Write-Host "Stopping api + casdoor (they hold DB connections)..." -ForegroundColor Cyan
-docker compose stop api casdoor
-if ($LASTEXITCODE -ne 0) { exit 1 }
-
-Write-Host "Restoring procurement DB..." -ForegroundColor Cyan
-docker cp "backups\procurement.dump" procurement-postgres:/tmp/procurement.dump
-docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists --single-transaction /tmp/procurement.dump
-if ($LASTEXITCODE -ne 0) { Write-Host "procurement restore FAILED" -ForegroundColor Red; exit 1 }
-
-Write-Host "Restoring casdoor DB..." -ForegroundColor Cyan
-docker cp "backups\casdoor.dump" procurement-postgres:/tmp/casdoor.dump
-docker exec procurement-postgres pg_restore -U postgres -d casdoor --clean --if-exists --single-transaction /tmp/casdoor.dump
-if ($LASTEXITCODE -ne 0) { Write-Host "casdoor restore FAILED" -ForegroundColor Red; exit 1 }
-
-Write-Host "Starting services..." -ForegroundColor Cyan
-docker compose start casdoor api
-if ($LASTEXITCODE -ne 0) { exit 1 }
-
-Write-Host ""
-Write-Host "Restore complete." -ForegroundColor Green
-Write-Host "App      : http://localhost" -ForegroundColor Green
-Write-Host "Casdoor  : http://localhost:8080  (admin / 123)" -ForegroundColor Green

backups/restore.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# Restore the committed demo-state dumps (backups/*.dump) into the running
-# stack (Linux/macOS/Git Bash). REPLACES all data in the `procurement` and
-# `casdoor` databases.
-#
-#   bash backups/restore.sh
-set -euo pipefail
-cd "$(dirname "$0")/.."
-
-echo "Stopping api + casdoor (they hold DB connections)..."
-docker compose stop api casdoor
-
-echo "Restoring procurement DB..."
-docker cp backups/procurement.dump procurement-postgres:/tmp/procurement.dump
-docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists --single-transaction /tmp/procurement.dump
-
-echo "Restoring casdoor DB..."
-docker cp backups/casdoor.dump procurement-postgres:/tmp/casdoor.dump
-docker exec procurement-postgres pg_restore -U postgres -d casdoor --clean --if-exists --single-transaction /tmp/casdoor.dump
-
-echo "Starting services..."
-docker compose start casdoor api
-
-echo ""
-echo "Restore complete."
-echo "App      : http://localhost"
-echo "Casdoor  : http://localhost:8080  (admin / 123)"

docker-compose.coolify.yml

@@ -0,0 +1,235 @@
+services:
+  api:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    container_name: procurement-api
+    depends_on:
+      minio-init:
+        condition: service_completed_successfully
+        required: true
+      postgres:
+        condition: service_healthy
+        required: true
+    environment:
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: "123"
+      PROCUREMENT_CASDOOR_ADMIN_USER: admin
+      PROCUREMENT_CASDOOR_APP_NAME: inventory-app
+      PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
+      PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: inventory-app-secret-2026
+      PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
+      PROCUREMENT_CASDOOR_ISSUER: https://${AUTH_HOST}
+      PROCUREMENT_CASDOOR_ORGANIZATION: inventory
+      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:postgres@postgres:5432/procurement
+      PROCUREMENT_MINIO_ACCESS_KEY: minioadmin
+      PROCUREMENT_MINIO_BUCKET: procurement-files
+      PROCUREMENT_MINIO_ENDPOINT: minio:9000
+      PROCUREMENT_MINIO_SECRET_KEY: minioadmin
+      PROCUREMENT_MINIO_SECURE: "false"
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.api-redir.entrypoints: web
+      traefik.http.routers.api-redir.middlewares: redirect-https@file
+      traefik.http.routers.api-redir.rule: Host(`${API_HOST}`)
+      traefik.http.routers.api.entrypoints: websecure
+      traefik.http.routers.api.rule: Host(`${API_HOST}`)
+      traefik.http.routers.api.tls: "true"
+      traefik.http.routers.api.tls.certresolver: letsencrypt
+      traefik.http.services.api.loadbalancer.server.port: "8000"
+    networks:
+      default: null
+      traefik_network: null
+    ports:
+      - "8000"
+    restart: unless-stopped
+
+  casdoor:
+    container_name: procurement-casdoor
+    depends_on:
+      postgres:
+        condition: service_healthy
+        required: true
+    environment:
+      RUNNING_IN_DOCKER: "true"
+      dataSourceName: "user=postgres password=postgres host=postgres port=5432 sslmode=disable dbname=casdoor"
+      dbName: casdoor
+      driverName: postgres
+      origin: https://${AUTH_HOST}
+    image: casbin/casdoor:latest
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.casdoor-redir.entrypoints: web
+      traefik.http.routers.casdoor-redir.middlewares: redirect-https@file
+      traefik.http.routers.casdoor-redir.rule: Host(`${AUTH_HOST}`)
+      traefik.http.routers.casdoor.entrypoints: websecure
+      traefik.http.routers.casdoor.rule: Host(`${AUTH_HOST}`)
+      traefik.http.routers.casdoor.tls: "true"
+      traefik.http.routers.casdoor.tls.certresolver: letsencrypt
+      traefik.http.services.casdoor.loadbalancer.server.port: "8000"
+    networks:
+      default: null
+      traefik_network: null
+    ports:
+      - "8081:8000"
+    restart: unless-stopped
+
+  frontend:
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile
+      args:
+        DEV_LOGIN_ENABLED: "true"
+    container_name: procurement-frontend
+    depends_on:
+      api:
+        condition: service_started
+        required: true
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.frontend-redir.entrypoints: web
+      traefik.http.routers.frontend-redir.middlewares: redirect-https@file
+      traefik.http.routers.frontend-redir.rule: Host(`${APP_HOST}`)
+      traefik.http.routers.frontend.entrypoints: websecure
+      traefik.http.routers.frontend.rule: Host(`${APP_HOST}`)
+      traefik.http.routers.frontend.tls: "true"
+      traefik.http.routers.frontend.tls.certresolver: letsencrypt
+      traefik.http.services.frontend.loadbalancer.server.port: "80"
+    networks:
+      default: null
+      traefik_network: null
+    restart: unless-stopped
+
+  minio:
+    command:
+      - server
+      - /data
+      - --console-address
+      - :9001
+    container_name: procurement-minio
+    environment:
+      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_USER: minioadmin
+    image: minio/minio:latest
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.minio-api-redir.entrypoints: web
+      traefik.http.routers.minio-api-redir.middlewares: redirect-https@file
+      traefik.http.routers.minio-api-redir.rule: Host(`${S3_HOST}`)
+      traefik.http.routers.minio-api.entrypoints: websecure
+      traefik.http.routers.minio-api.rule: Host(`${S3_HOST}`)
+      traefik.http.routers.minio-api.service: minio-api-svc
+      traefik.http.routers.minio-api.tls: "true"
+      traefik.http.routers.minio-api.tls.certresolver: letsencrypt
+      traefik.http.routers.minio-console-redir.entrypoints: web
+      traefik.http.routers.minio-console-redir.middlewares: redirect-https@file
+      traefik.http.routers.minio-console-redir.rule: Host(`${STORAGE_HOST}`)
+      traefik.http.routers.minio-console.entrypoints: websecure
+      traefik.http.routers.minio-console.rule: Host(`${STORAGE_HOST}`)
+      traefik.http.routers.minio-console.service: minio-console-svc
+      traefik.http.routers.minio-console.tls: "true"
+      traefik.http.routers.minio-console.tls.certresolver: letsencrypt
+      traefik.http.services.minio-api-svc.loadbalancer.server.port: "9000"
+      traefik.http.services.minio-console-svc.loadbalancer.server.port: "9001"
+    networks:
+      default: null
+      traefik_network: null
+    ports:
+      - "9000"
+      - "9001"
+    restart: unless-stopped
+    volumes:
+      - minio_data:/data
+
+  minio-init:
+    container_name: procurement-minio-init
+    depends_on:
+      minio:
+        condition: service_started
+        required: true
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        until mc alias set local http://$${MINIO_ENDPOINT} $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD}; do
+          echo 'waiting for minio server...';
+          sleep 2;
+        done;
+        mc mb --ignore-existing local/$${MINIO_BUCKET};
+        echo bucket $${MINIO_BUCKET} ready;
+    environment:
+      MINIO_BUCKET: procurement-files
+      MINIO_ENDPOINT: minio:9000
+      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_USER: minioadmin
+    image: minio/mc:latest
+    networks:
+      default: null
+    restart: 'no'
+
+  postgres:
+    container_name: procurement-postgres
+    environment:
+      POSTGRES_DB: procurement
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_USER: postgres
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - pg_isready -U postgres -d procurement
+      timeout: 5s
+      interval: 5s
+      retries: 10
+    image: postgres:18
+    networks:
+      default: null
+    ports:
+      - "5433:5432"
+    restart: unless-stopped
+    volumes:
+      - postgres_data:/var/lib/postgresql
+      - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro
+      - ./sql/02-casdoor-db.sql:/docker-entrypoint-initdb.d/02-casdoor-db.sql:ro
+
+  traefik:
+    command:
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.network=traefik_network
+      - --providers.file.filename=/etc/traefik/dynamic.yml
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL}
+      - --certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
+      - --log.level=INFO
+    container_name: procurement-traefik
+    environment:
+      TRAEFIK_ACME_EMAIL: ${TRAEFIK_ACME_EMAIL}
+    image: traefik:v3.6
+    networks:
+      traefik_network: null
+    ports:
+      - "80"
+      - "443"
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./infra/traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
+      - traefik_certs:/certs
+
+networks:
+  default:
+    name: v15_default
+  traefik_network:
+    name: traefik_network
+    driver: bridge
+
+volumes:
+  minio_data:
+    name: v15_minio_data
+  postgres_data:
+    name: v15_postgres_data
+  traefik_certs:
+    name: v15_traefik_certs

docker-compose.prod.yml

@@ -1,32 +1,72 @@
 # ============================================================================
 # Production overlay — real domains + HTTPS (Let's Encrypt) + HTTP→HTTPS
-# redirect. Usage:
+# redirect + security middlewares + required secrets.
 #
-#   APP_HOST=app.example.com API_HOST=api.example.com AUTH_HOST=auth.example.com \
-#   S3_HOST=s3.example.com STORAGE_HOST=storage.example.com \
-#   TRAEFIK_ACME_EMAIL=admin@example.com \
+# All credentials come from the git-ignored .env NEXT TO THE COMPOSE FILES
+# (compose loads it automatically — keep it on the VPS, never in git):
+#
+#   cp .env.example .env   # then fill in STRONG values
 #   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
 #
 # Requirements: DNS records for every host pointing at the server, ports
-# 80 + 443 open (ACME http-challenge uses port 80), and the api's
-# PROCUREMENT_CASDOOR_ISSUER must be updated to the public auth host
-# (see docs/casdoor-auth.md).
+# 80 + 443 open (ACME http-challenge uses port 80). The api's issuer is
+# derived here from AUTH_HOST (see docs/casdoor-auth.md).
+#
+# Any `${VAR:?}` below refuses to boot when the variable is missing/empty —
+# that is deliberate: production must not run on defaults.
 # ============================================================================
 
 services:
   traefik:
     environment:
       # Certificates persist across restarts (acme.json in the traefik_certs volume).
-      TRAEFIK_ACME_EMAIL: ${TRAEFIK_ACME_EMAIL:?set TRAEFIK_ACME_EMAIL for production}
+      TRAEFIK_ACME_EMAIL: ${TRAEFIK_ACME_EMAIL:?set TRAEFIK_ACME_EMAIL in .env}
+
+  postgres:
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+
+  minio:
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?set MINIO_ROOT_USER in .env}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?set MINIO_ROOT_PASSWORD in .env}
+    labels:
+      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:?set S3_HOST}`)
+      - traefik.http.routers.minio-api.entrypoints=websecure
+      - traefik.http.routers.minio-api.tls=true
+      - traefik.http.routers.minio-api.tls.certresolver=letsencrypt
+      - traefik.http.routers.minio-api.middlewares=secure-headers@file
+      - traefik.http.routers.minio-api-redir.rule=Host(`${S3_HOST:?set S3_HOST}`)
+      - traefik.http.routers.minio-api-redir.entrypoints=web
+      - traefik.http.routers.minio-api-redir.middlewares=redirect-https@file
+      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
+      - traefik.http.routers.minio-console.entrypoints=websecure
+      - traefik.http.routers.minio-console.tls=true
+      - traefik.http.routers.minio-console.tls.certresolver=letsencrypt
+      - traefik.http.routers.minio-console.middlewares=secure-headers@file
+      - traefik.http.routers.minio-console-redir.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
+      - traefik.http.routers.minio-console-redir.entrypoints=web
+      - traefik.http.routers.minio-console-redir.middlewares=redirect-https@file
 
   api:
     ports: [] # production: only reachable through Traefik
+    environment:
+      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/procurement
+      PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?set MINIO_ROOT_USER in .env}
+      PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?set MINIO_ROOT_PASSWORD in .env}
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:?set CASDOOR_CLIENT_SECRET in .env}
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:?set CASDOOR_ADMIN_PASSWORD in .env}
+      # Issuer must equal the browser-facing Casdoor origin (its discovery doc).
+      PROCUREMENT_CASDOOR_ISSUER: https://${AUTH_HOST:?set AUTH_HOST}
+      PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:?set CORS_ORIGINS in .env}
+      PROCUREMENT_ENVIRONMENT: prod
+      PROCUREMENT_DEV_LOGIN_ENABLED: "false"
     labels:
       - traefik.http.routers.api.rule=Host(`${API_HOST:?set API_HOST}`)
       - traefik.http.routers.api.entrypoints=websecure
       - traefik.http.routers.api.tls=true
       - traefik.http.routers.api.tls.certresolver=letsencrypt
-      # HTTP → HTTPS
+      - traefik.http.routers.api.middlewares=secure-headers@file,api-ratelimit@file,api-bodylimit@file
       - traefik.http.routers.api-redir.rule=Host(`${API_HOST:?set API_HOST}`)
       - traefik.http.routers.api-redir.entrypoints=web
       - traefik.http.routers.api-redir.middlewares=redirect-https@file
@@ -41,34 +81,21 @@ services:
       - traefik.http.routers.casdoor.entrypoints=websecure
       - traefik.http.routers.casdoor.tls=true
       - traefik.http.routers.casdoor.tls.certresolver=letsencrypt
+      - traefik.http.routers.casdoor.middlewares=secure-headers@file
       - traefik.http.routers.casdoor-redir.rule=Host(`${AUTH_HOST:?set AUTH_HOST}`)
       - traefik.http.routers.casdoor-redir.entrypoints=web
       - traefik.http.routers.casdoor-redir.middlewares=redirect-https@file
 
   frontend:
+    build:
+      args:
+        DEV_LOGIN_ENABLED: "false"
     labels:
       - traefik.http.routers.frontend.rule=Host(`${APP_HOST:?set APP_HOST}`)
       - traefik.http.routers.frontend.entrypoints=websecure
       - traefik.http.routers.frontend.tls=true
       - traefik.http.routers.frontend.tls.certresolver=letsencrypt
+      - traefik.http.routers.frontend.middlewares=secure-headers@file
       - traefik.http.routers.frontend-redir.rule=Host(`${APP_HOST:?set APP_HOST}`)
       - traefik.http.routers.frontend-redir.entrypoints=web
       - traefik.http.routers.frontend-redir.middlewares=redirect-https@file
-
-  minio:
-    ports: [] # production: only reachable through Traefik
-    labels:
-      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:?set S3_HOST}`)
-      - traefik.http.routers.minio-api.entrypoints=websecure
-      - traefik.http.routers.minio-api.tls=true
-      - traefik.http.routers.minio-api.tls.certresolver=letsencrypt
-      - traefik.http.routers.minio-api-redir.rule=Host(`${S3_HOST:?set S3_HOST}`)
-      - traefik.http.routers.minio-api-redir.entrypoints=web
-      - traefik.http.routers.minio-api-redir.middlewares=redirect-https@file
-      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
-      - traefik.http.routers.minio-console.entrypoints=websecure
-      - traefik.http.routers.minio-console.tls=true
-      - traefik.http.routers.minio-console.tls.certresolver=letsencrypt
-      - traefik.http.routers.minio-console-redir.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
-      - traefik.http.routers.minio-console-redir.entrypoints=web
-      - traefik.http.routers.minio-console-redir.middlewares=redirect-https@file

docker-compose.yml

@@ -6,11 +6,17 @@ services:
     environment:
       POSTGRES_DB: procurement
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
+      # Local dev default; production overrides via .env (required by the
+      # prod overlay) — never commit real passwords.
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
 
     ports:
       - "5433:5432"
 
+    networks:
+      - default
+      - shared # monitoring stack scrapes it (postgres-exporter)
+
     volumes:
       - postgres_data:/var/lib/postgresql
       - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro
@@ -23,6 +29,7 @@ services:
       retries: 10
 
     restart: unless-stopped
+    mem_limit: 1g
 
   # ==========================================================================
   # Traefik v3 — public reverse proxy (replaces nginx as the edge)
@@ -36,6 +43,7 @@ services:
     image: traefik:v3.6
     container_name: procurement-traefik
     restart: unless-stopped
+    mem_limit: 128m
     command:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
@@ -69,8 +77,8 @@ services:
     command: server /data --console-address ":9001"
 
     environment:
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
 
     ports:
       - "9000:9000"   # S3 API
@@ -97,6 +105,7 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 512m
 
   # MinIO Client (mc): waits for the server, creates the bucket, exits.
   # Use for ad-hoc ops too: docker compose run --rm minio-init ...
@@ -110,8 +119,8 @@ services:
 
     environment:
       MINIO_ENDPOINT: minio:9000
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
       MINIO_BUCKET: procurement-files
 
     entrypoint: >
@@ -125,6 +134,40 @@ services:
 
     restart: "no"
 
+  # ==========================================================================
+  # Scheduled logical backups of BOTH databases (procurement + casdoor).
+  # Writes pg_dump -Fc archives to a bind mount (default ./backups, point
+  # BACKUP_DIR at /srv/erp/backups on the VPS) and prunes archives older
+  # than BACKUP_KEEP_DAYS. Runs on the same postgres:18 image already pulled.
+  # ==========================================================================
+  db-backup:
+    image: postgres:18
+    container_name: procurement-db-backup
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      PGPASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      BACKUP_INTERVAL_SECONDS: ${BACKUP_INTERVAL_SECONDS:-86400}
+      BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS:-14}
+    volumes:
+      - ${BACKUP_DIR:-./backups}:/backups
+    entrypoint: >
+      /bin/sh -c "
+      echo 'db-backup: dumping every $${BACKUP_INTERVAL_SECONDS}s, keeping $${BACKUP_KEEP_DAYS} days';
+      while true; do
+        STAMP=$$(date +%Y%m%d-%H%M%S);
+        pg_dump -h postgres -U postgres -d procurement -Fc -f /backups/procurement-$${STAMP}.dump &&
+          echo \"db-backup: procurement -> /backups/procurement-$${STAMP}.dump\";
+        pg_dump -h postgres -U postgres -d casdoor -Fc -f /backups/casdoor-$${STAMP}.dump &&
+          echo \"db-backup: casdoor -> /backups/casdoor-$${STAMP}.dump\";
+        find /backups -name '*.dump' -mtime +$${BACKUP_KEEP_DAYS} -delete;
+        sleep $${BACKUP_INTERVAL_SECONDS};
+      done
+      "
+    restart: unless-stopped
+    mem_limit: 256m
+
   # ==========================================================================
   # v2.6 — Casdoor (OIDC identity provider)
   # Console: http://localhost:8080 (admin / 123)
@@ -162,6 +205,7 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 768m
 
   api:
     build:
@@ -170,38 +214,58 @@ services:
     container_name: procurement-api
 
     environment:
-      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:postgres@postgres:5432/procurement
+      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/procurement
       PROCUREMENT_MINIO_ENDPOINT: minio:9000
-      PROCUREMENT_MINIO_ACCESS_KEY: minioadmin
-      PROCUREMENT_MINIO_SECRET_KEY: minioadmin
+      PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
+      PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
       PROCUREMENT_MINIO_BUCKET: procurement-files
       PROCUREMENT_MINIO_SECURE: "false"
+      # "dev" enables the local defaults; "prod" turns on the fail-fast
+      # startup checks (no wildcard CORS, no default credentials).
+      PROCUREMENT_ENVIRONMENT: ${ENVIRONMENT:-dev}
+      PROCUREMENT_DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
+      # Comma-separated browser origins (JSON-free .env friendly).
+      PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost,http://localhost:3000,http://localhost:5173}
       # Casdoor: endpoint is the in-network service URL; the issuer must match
       # the origin Casdoor advertises to browsers (its OIDC discovery doc).
       PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
-      PROCUREMENT_CASDOOR_ISSUER: http://localhost:8080
+      PROCUREMENT_CASDOOR_ISSUER: ${CASDOOR_ISSUER:-http://localhost:8080}
       PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
-      PROCUREMENT_CASDOOR_CLIENT_SECRET: inventory-app-secret-2026
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:-inventory-app-secret-2026}
       PROCUREMENT_CASDOOR_ORGANIZATION: inventory
       PROCUREMENT_CASDOOR_APP_NAME: inventory-app
       PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
       # Console admin used by POST /users/sync (identity mirroring).
       PROCUREMENT_CASDOOR_ADMIN_USER: admin
-      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: "123"
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:-123}
+      # Observability (Phase 2) — see monitoring/README.md
+      PROCUREMENT_LOG_FORMAT: ${LOG_FORMAT:-text}
+      PROCUREMENT_SENTRY_DSN: ${SENTRY_DSN_BACKEND:-}
+      PROCUREMENT_OPENPANEL_API_URL: ${OPENPANEL_API_URL:-}
+      PROCUREMENT_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-}
+      PROCUREMENT_OPENPANEL_CLIENT_SECRET: ${OPENPANEL_CLIENT_SECRET:-}
 
     ports:
       - "8000:8000"
 
+    networks:
+      - traefik_network
+      - default
+      - shared # monitoring stack scrapes api:8000/metrics
+
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request as u; u.urlopen('http://127.0.0.1:8000/health', timeout=3)\""]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 40s
+
     labels:
       - traefik.enable=true
       - traefik.http.routers.api.rule=Host(`${API_HOST:-api.localhost}`)
       - traefik.http.routers.api.entrypoints=web
       - traefik.http.services.api.loadbalancer.server.port=8000
 
-    networks:
-      - traefik_network
-      - default
-
     depends_on:
       postgres:
         condition: service_healthy
@@ -209,13 +273,21 @@ services:
         condition: service_completed_successfully
 
     restart: unless-stopped
+    mem_limit: 768m
 
   frontend:
     build:
       context: ./frontend
       args:
-        # Developer Mode panel on the login page — set false for production.
-        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-true}
+        # Developer Mode panel on the login page — dev-only aid. Production
+        # builds MUST leave this false (identity comes from Casdoor tokens).
+        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
+        # Registry overridable for networks where npmmirror is unreachable.
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
+        # Observability (build-time baked; empty = disabled)
+        VITE_OPENPANEL_URL: ${OPENPANEL_PUBLIC_URL:-}
+        VITE_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-}
+        VITE_SENTRY_DSN: ${SENTRY_DSN_FRONTEND:-}
     container_name: procurement-frontend
 
     labels:
@@ -232,6 +304,7 @@ services:
       - api
 
     restart: unless-stopped
+    mem_limit: 128m
 
 networks:
   # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی
@@ -239,6 +312,11 @@ networks:
   traefik_network:
     name: traefik_network
     driver: bridge
+  # Fixed-name network shared with the monitoring stack (monitoring compose
+  # joins it as external) — carries /metrics scrapes and postgres-exporter.
+  shared:
+    name: erp_shared
+    driver: bridge
 
 volumes:
   postgres_data:

docs/OPERATIONS.md

@@ -0,0 +1,96 @@
+# Operations runbook
+
+Day-2 operations for the ERP stack: deploys, health, backups, monitoring.
+Secrets and rotation live in [`SECRET-MANAGEMENT.md`](SECRET-MANAGEMENT.md);
+Casdoor/auth details in [`casdoor-auth.md`](casdoor-auth.md).
+
+## Deploy flow (push-to-deploy)
+
+1. Work lands on `production` only via merge from a feature branch.
+2. Every push to `production` hits the webhook receiver (host port 9000),
+   which verifies the Gitea HMAC signature, rebuilds
+   `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build`
+   and then polls `/health/ready` (defaults to
+   `https://$API_HOST/health/ready` from `.env`).
+3. A failed build or a failed readiness check is a **failed deploy**:
+   `journalctl -u erp-deploy-webhook -n 200` on the VPS.
+   Rollback: `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --no-build`
+   after `git revert` + rebuild — or re-push the previous commit.
+
+## Health endpoints (unauthenticated, for probes)
+
+| Endpoint | Meaning |
+|---|---|
+| `GET /health` | liveness — process is up |
+| `GET /health/ready` | readiness — Postgres + MinIO + Casdoor all reachable (503 + per-check booleans when degraded) |
+| `GET /metrics` | Prometheus exposition (scraped by the monitoring stack) |
+
+## Backups
+
+The `db-backup` sidecar dumps BOTH databases (`procurement`, `casdoor`)
+with `pg_dump -Fc` every `BACKUP_INTERVAL_SECONDS` (default daily) into
+`BACKUP_DIR` (default `./backups` → set to `/srv/erp/backups` on the VPS),
+keeping `BACKUP_KEEP_DAYS` (default 14) days.
+
+Restore (⚠️ replaces all data — stop `api` + `casdoor` first):
+
+```bash
+cd /srv/erp && docker compose -f docker-compose.yml -f docker-compose.prod.yml stop api casdoor
+docker cp backups/procurement-<stamp>.dump procurement-postgres:/tmp/
+docker cp backups/casdoor-<stamp>.dump procurement-postgres:/tmp/
+docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists /tmp/procurement-<stamp>.dump
+docker exec procurement-postgres pg_restore -U postgres -d casdoor --clean --if-exists /tmp/casdoor-<stamp>.dump
+docker compose -f docker-compose.yml -f docker-compose.prod.yml start casdoor api
+```
+
+**Test the restore quarterly** on a scratch volume — an untested backup is
+a hope, not a backup. Copy archives off-box periodically (the bind mount is
+still on the same disk as the volumes).
+
+## Audit trail
+
+`audit_log` (in the `procurement` DB) records who changed what for
+role assignments, user creation, and inventory transactions. Query recent
+activity:
+
+```bash
+docker exec procurement-postgres psql -U postgres -d procurement \
+  -c "SELECT occurred_at, actor, action, entity, entity_id FROM audit_log ORDER BY occurred_at DESC LIMIT 50;"
+```
+
+`quote_events` continues to hold the quote lifecycle history (its `actor`
+is now the verified user's display name, not a raw token).
+
+## Monitoring stack
+
+Start/update (separate compose project — app rebuilds don't touch it):
+
+```bash
+cd /srv/erp
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+```
+
+- **Grafana** — `127.0.0.1:3001` on the VPS (SSH tunnel), admin password in
+  `.env`; the «ERP — Stack overview» dashboard auto-provisions.
+- **GlitchTip** — public on `GLITCHTIP_HOST` (browser DSN) + loopback
+  `:8001` for administration. Create backend/frontend projects there and put
+  the DSNs in `.env` (`SENTRY_DSN_BACKEND` / `SENTRY_DSN_FRONTEND`).
+- **OpenPanel** — see `monitoring/README.md` for the self-hosting setup and
+  the event list the app emits.
+- **Alerts** — Prometheus rules surface in Grafana alerting (API down,
+  5xx rate, p95 latency, disk, RAM, DB connections). Attach a notification
+  channel in the Grafana UI.
+
+Logs: every container's stdout ships to Loki via Promtail — in Grafana:
+`{compose_project="erp", compose_service="api"}`; JSON lines carry
+`request_id`, `http_status`, `duration_ms`.
+
+## Routine checks
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.prod.yml ps   # all Up/healthy?
+docker compose logs --since 10m api | grep -i error
+ls -lh /srv/erp/backups | tail                                       # dumps fresh?
+curl -fsS https://$API_HOST/health/ready | jq                        # all checks true?
+df -h /                                                              # ≥20% free (builds need headroom)
+```

docs/SECRET-MANAGEMENT.md

@@ -0,0 +1,67 @@
+# Secret management & rotation
+
+**Policy (short):** real credentials live only in git-ignored `.env` files —
+the server-side `/srv/erp/.env` (used by the deploy webhook and compose) and
+local dev `.env` copies. Nothing secret goes into git: not in the README,
+not in dumps, not in docs. The repo is (or was) **public** — assume anything
+ever committed is compromised and rotate.
+
+`docker-compose.prod.yml` declares every production secret as
+`${VAR:?set in .env}` so the stack **refuses to boot** on defaults.
+
+## Where each secret lives
+
+| Secret | Used by | Defined in |
+|---|---|---|
+| `POSTGRES_PASSWORD` | postgres, api | server `.env` |
+| `MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD` | minio, minio-init, api | server `.env` |
+| `CASDOOR_CLIENT_SECRET` | Casdoor application record, api | server `.env` (must match the app in the Casdoor console) |
+| `CASDOOR_ADMIN_PASSWORD` | Casdoor console admin, api (`/users/sync`) | server `.env` (rotate in the Casdoor console too) |
+| `CORS_ORIGINS`, `*_HOST`, `TRAEFIK_ACME_EMAIL` | compose / Traefik | server `.env` |
+| `GITEA_WEBHOOK_SECRET` | deploy-webhook receiver (port 9000) | server `.env` + Gitea webhook config |
+| Monitoring DSNs/keys | OpenPanel, GlitchTip, Grafana | `monitoring/.env` (server-side) |
+
+## Rotation checklist — run after any leak suspicion
+
+The production branch history contained real credentials (MinIO admin,
+Casdoor passwords, server IP, DB dumps). All of the following must be
+rotated once, on the VPS:
+
+```bash
+cd /srv/erp
+
+# 1) MinIO root — then update MINIO_ROOT_* in /srv/erp/.env
+mc alias set local http://127.0.0.1:9000 <old-user> '<old-pass>'
+mc admin user add local <new-user> '<new-pass>'      # then:
+mc admin policy attach local consoleAdmin --user <new-user>
+mc admin user remove local <old-user>
+# (simplest equivalent: mc admin user svcacct or change root via env +
+#  `docker compose up -d minio` — MinIO persists root creds from env)
+
+# 2) PostgreSQL — then update POSTGRES_PASSWORD in .env
+docker exec -it procurement-postgres psql -U postgres -c \
+  "ALTER USER postgres PASSWORD '<new-strong-password>';"
+docker compose up -d api   # api re-reads the DSN from .env
+
+# 3) Casdoor console admin (console → Identity → users → admin → reset
+#    password) — then update CASDOOR_ADMIN_PASSWORD in .env
+# 4) Casdoor application client secret (console → Applications →
+#    inventory-app → edit secret) — then update CASDOOR_CLIENT_SECRET in .env
+# 5) Seeded human users: reset each password in the Casdoor console.
+# 6) Gitea webhook secret (Gitea → repo → Settings → Webhooks) — then update
+#    GITEA_WEBHOOK_SECRET in .env and restart the receiver (systemctl restart erp-deploy-webhook)
+
+# 7) Apply everything:
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+```
+
+- **SSH**: disable password login (`PasswordAuthentication no` in
+  `/etc/ssh/sshd_config`), use keys only, and prefer a non-root user with
+  sudo over `root` direct login.
+- **Repo hygiene**: keep the repo private until the git history is either
+  purged (BFG / `git filter-repo` on the README + `backups/` blobs) or every
+  leaked value is rotated. Deleting a file in a later commit does **not**
+  remove it from history.
+- **Verify**: after rotation, `docker compose logs api | grep -i error`,
+  log into the app, upload + download one attachment, and confirm the
+  webhook deploy still works with a test push.

docs/casdoor-auth.md

@@ -12,7 +12,7 @@ scenarios, test results, and how to manage the system yourself.
 |---|---|---|
 | App (frontend) | http://localhost (Traefik edge; production: your domain) | — |
 | API (backend) | http://localhost:8000 (Swagger: `/docs`) | — |
-| Casdoor console | http://localhost:8080 | **admin / 123** (built-in org) |
+| Casdoor console | http://localhost:8080 | admin credentials come from `CASDOOR_ADMIN_PW` when running the seeder — never committed |
 | Casdoor OIDC discovery | http://localhost:8080/.well-known/openid-configuration | — |
 | Casdoor public JWKS | http://localhost:8080/.well-known/jwks | — |
 | In-network Casdoor (from the api container) | http://casdoor:8000 | — |
@@ -22,20 +22,20 @@ scenarios, test results, and how to manage the system yourself.
 
 | Username | Password | Casdoor org | App role (our `users` table) |
 |---|---|---|---|
-| `razaei` | `123456` | inventory | `admin` (super user) |
-| `mousavi` | `123456` | inventory | `procurement_manager` (مدیر تدارکات) |
-| `mohaghegh` | `123456` | inventory | `pm` (مدیر پروژه، بدون پروژه) |
-| `tester` | `123456` | inventory | `pm` (مدیر پروژه — پروژه «تست») |
+| `razaei` | `CASDOOR_SEED_PASSWORD` | inventory | `admin` (super user) |
+| `mousavi` | `CASDOOR_SEED_PASSWORD` | inventory | `procurement_manager` (مدیر تدارکات) |
+| `mohaghegh` | `CASDOOR_SEED_PASSWORD` | inventory | `pm` (مدیر پروژه، بدون پروژه) |
+| `tester` | `CASDOOR_SEED_PASSWORD` | inventory | `pm` (مدیر پروژه — پروژه «تست») |
 
-These users are created by `backend/tools/seed_casdoor.py` (idempotent — safe
-to re-run).
+Passwords are stored bcrypt-hashed (passwordType `bcrypt`). These users are
+created by `backend/tools/seed_casdoor.py` (idempotent — safe to re-run).
 
 ---
 
 ## 2. Login flow (in-page, no redirect)
 
 ```
-Browser ──► POST /api/v1/auth/login {username, password, organization?}
+Browser ──► POST /api/v1/auth/login {username, password}
               │
               ▼
 Backend  ──► POST http://casdoor:8000/api/login/oauth/access_token
@@ -95,7 +95,7 @@ identity only.** No new authorization model was introduced.
   the OIDC client. Grant types: `authorization_code`, `refresh_token`,
   `password`. Token format JWT (so the backend can verify via JWKS).
 - **Casdoor Organization** (`inventory`): the tenant; every app user belongs
-  to it. (The Casdoor console admin `admin/123` lives in the separate
+  to it. (The Casdoor console admin lives in the separate
   `built-in` org.)
 - **User — two records per person:**
   1. Casdoor user (login credential: name + password).
@@ -158,7 +158,7 @@ After that, log in as the admin and use the Organization panel
 
 | Test | Action | Result | Evidence |
 |---|---|---|---|
-| 1 | Login: `POST /api/v1/auth/login` (tester/123456) | **PASS** | 200, JWT + profile returned |
+| 1 | Login: `POST /api/v1/auth/login` (tester / CASDOOR_SEED_PASSWORD) | **PASS** | 200, JWT + profile returned |
 | 2 | Authenticated API: `GET /users/me` with token | **PASS** | 200, role `pm` + project «تست» |
 | 3 | No token: `GET /inventory/warehouses` | **PASS** | 401 `UNAUTHORIZED` |
 | 4 | Invalid token: corrupted Bearer | **PASS** | 401 `UNAUTHORIZED` «توکن نامعتبر است» |
@@ -179,7 +179,7 @@ After that, log in as the admin and use the Organization panel
 | 6 | Organization exists | ✅ `inventory` |
 | 7 | Application exists | ✅ `inventory-app` |
 | 8 | Client exists | ✅ `inventory-app-client` (grants incl. `password`) |
-| 9 | Test users exist | ✅ razaei, mousavi, mohaghegh, tester (password 123456) |
+| 9 | Test users exist | ✅ razaei, mousavi, mohaghegh, tester (password: CASDOOR_SEED_PASSWORD) |
 | 10 | Redirect URI matches | ✅ N/A for the in-page flow (redirects unused). The seeded app holds the legacy `http://localhost:3000/login`; the seeder now defaults to `http://localhost/login` |
 | 11 | OIDC works | ✅ discovery doc + token endpoint + JWT issuance verified |
 | 12 | PKCE works | ➖ **N/A** — the PKCE/redirect flow was replaced by the in-page password-grant login (per the redesign spec); nothing to verify |
@@ -270,7 +270,7 @@ After that, log in as the admin and use the Organization panel
 
 ## 9. Managing Casdoor yourself
 
-- **Console:** http://localhost:8080 — log in as **admin / 123**. From there
+- **Console:** http://localhost:8080 — log in as the admin (credentials from the seeder run). From there
   you can manage Organizations, Users, Applications, Providers, Certificates.
 - **Seeding** (org `inventory`, app `inventory-app`, the four users) —
   re-runnable at any time:

frontend/.env.example

@@ -5,6 +5,13 @@
 VITE_API_BASE_URL=
 
 # Show the "Developer Mode" panel on the login page.
-# true (default) / false — in Docker builds this is controlled by the
-# DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
-VITE_ENABLE_DEV_LOGIN=true
+# true (default in local dev) / false — in Docker builds this is controlled
+# by the DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
+VITE_ENABLE_DEV_LOGIN=
+
+# ---- Observability (all optional — empty = disabled, no network calls) ----
+# OpenPanel: browser origin of the self-hosted dashboard/API + project client id.
+VITE_OPENPANEL_URL=
+VITE_OPENPANEL_CLIENT_ID=
+# GlitchTip/Sentry DSN for frontend exception capture.
+VITE_SENTRY_DSN=

frontend/Dockerfile

@@ -13,11 +13,21 @@ ARG NPM_REGISTRY=https://registry.npmmirror.com
 COPY package.json package-lock.json ./
 RUN npm config set registry ${NPM_REGISTRY} && npm ci
 
-# Developer Mode panel on the login page (default enabled; set to
-# "false" to build a production login without the dev panel).
-ARG DEV_LOGIN_ENABLED=true
+# Developer Mode panel on the login page (dev-only aid). Production builds
+# MUST keep this "false" — identity comes from Casdoor tokens, and the
+# backend rejects the X-User-* header path unless DEV_LOGIN_ENABLED=true.
+ARG DEV_LOGIN_ENABLED=false
 ENV VITE_ENABLE_DEV_LOGIN=${DEV_LOGIN_ENABLED}
 
+# Observability (Phase 2) — baked into the bundle at build time.
+# Empty values disable the feature (analytics.ts is a no-op then).
+ARG VITE_OPENPANEL_URL=""
+ARG VITE_OPENPANEL_CLIENT_ID=""
+ARG VITE_SENTRY_DSN=""
+ENV VITE_OPENPANEL_URL=${VITE_OPENPANEL_URL} \
+    VITE_OPENPANEL_CLIENT_ID=${VITE_OPENPANEL_CLIENT_ID} \
+    VITE_SENTRY_DSN=${VITE_SENTRY_DSN}
+
 # Source code + build
 COPY . .
 RUN npm run build

frontend/package-lock.json

@@ -11,11 +11,13 @@
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/utilities": "^3.2.2",
         "@hookform/resolvers": "3.10",
+        "@openpanel/web": "^1.0.1",
         "@radix-ui/react-checkbox": "^1.3.11",
         "@radix-ui/react-dialog": "^1.1.23",
         "@radix-ui/react-label": "^2.1.15",
         "@radix-ui/react-select": "^2.3.7",
         "@radix-ui/react-slot": "^1.3.3",
+        "@sentry/react": "^10.0.0",
         "@tailwindcss/vite": "^4.3.3",
         "@tanstack/react-query": "^5.101.4",
         "class-variance-authority": "^0.7.1",
@@ -172,6 +174,23 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@openpanel/sdk": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@openpanel/sdk/-/sdk-1.3.1.tgz",
+      "integrity": "sha512-mQ5xaBUGXnyRg3qYxwnbVaUYyW7w8u+munrWk/ClnqxEeR2j+FYPiA6noHbHMCFC2aZutYD5OoRzEvw3FBNFxw==",
+      "license": "MIT"
+    },
+    "node_modules/@openpanel/web": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/@openpanel/web/-/web-1.4.1.tgz",
+      "integrity": "sha512-DgUWeocZw+b57YiJjefZPg+6sceR7TdOF8x7Ut75lu3CwcwqGi5jZNPXjikNemGL37aNWXCB4buhcoNan2j7RA==",
+      "license": "MIT",
+      "dependencies": {
+        "@openpanel/sdk": "1.3.1",
+        "@rrweb/types": "2.0.0-alpha.20",
+        "rrweb": "2.0.0-alpha.20"
+      }
+    },
     "node_modules/@oxc-project/types": {
       "version": "0.143.0",
       "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
@@ -308,9 +327,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -328,9 +344,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -348,9 +361,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -368,9 +378,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -388,9 +395,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -408,9 +412,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -428,9 +429,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -448,9 +446,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1207,9 +1202,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1226,9 +1218,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1245,9 +1234,6 @@
       "cpu": [
         "ppc64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1264,9 +1250,6 @@
       "cpu": [
         "s390x"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1283,9 +1266,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1302,9 +1282,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1368,6 +1345,124 @@
       "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
       "license": "MIT"
     },
+    "node_modules/@rrweb/types": {
+      "version": "2.0.0-alpha.20",
+      "resolved": "https://registry.npmjs.org/@rrweb/types/-/types-2.0.0-alpha.20.tgz",
+      "integrity": "sha512-RbnDgKxA/odwB1R4gF7eUUj+rdSrq6ROQJsnMw7MIsGzlbSYvJeZN8YY4XqU0G6sKJvXI6bSzk7w/G94jNwzhw==",
+      "license": "MIT"
+    },
+    "node_modules/@rrweb/utils": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/@rrweb/utils/-/utils-2.1.6.tgz",
+      "integrity": "sha512-BIRXcxiytJs5Guxw0tzsnVS7ukcMqtnxixjIGvV49VdJeOEG6NJeMU7o8efbHW1D52a12Y8QsgDjgDgblg3org==",
+      "license": "MIT"
+    },
+    "node_modules/@sentry/browser": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-10.75.0.tgz",
+      "integrity": "sha512-CKGSJLWISQ6LgMaGnMpY+XvwWQ2iiHTayUs6SGLIvYeaGo2GTjS/Z4pnbCVHb2t1VxLZksyehgcC6ZYGJeQpzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser-utils": "10.75.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0",
+        "@sentry/feedback": "10.75.0",
+        "@sentry/replay": "10.75.0",
+        "@sentry/replay-canvas": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/browser-utils": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/browser-utils/-/browser-utils-10.75.0.tgz",
+      "integrity": "sha512-yZfdQ87RLat/7retF8zA6Z9zCAT12IyaPvIiu+bbi1E1V1OqDpS8MKNa/6LF69Ap7DVTORi9ITEgjlAqTXF0xQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/conventions": {
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.16.0.tgz",
+      "integrity": "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@sentry/core": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.0.tgz",
+      "integrity": "sha512-5wDQpQqjJ6RHdPR+z6Q+47XlwoxRKBv0yyB0LKHqL/1azPOQbR+nllyLmmQDcoJpaksuLSmLA1q6hFX7gjDT2w==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/feedback": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/feedback/-/feedback-10.75.0.tgz",
+      "integrity": "sha512-YLVAFQXELJAOg7ke4oLkd8t5l0fJUockLlTQJg/2Trh7SB5Q4mkSwlnAkEAqDQ618vnpFsG/tnYMwtfZeffHjA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/react": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/react/-/react-10.75.0.tgz",
+      "integrity": "sha512-ghWv99h7k4WgMucqBhf4jZn+G0Owm5gCBCVKOKu88UDCWUd9aVJ8FGosAkATp/x/ogcZTnqG2dcXBD+1U+BJeA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser": "10.75.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || 17.x || 18.x || 19.x"
+      }
+    },
+    "node_modules/@sentry/replay": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-10.75.0.tgz",
+      "integrity": "sha512-p4xxEo/ayiMZG9tygr09YjqYAd52uq8Qi0EVoRRgUe70nQda0HVPVW519JLq0G+Th/5O5sKME9y1layLU3xlPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser-utils": "10.75.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/replay-canvas": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/replay-canvas/-/replay-canvas-10.75.0.tgz",
+      "integrity": "sha512-LNokI5Ud22nZ/o2il/2SfbNIARupWrbS6Mh9jZroZTjD38FN0Oi9vIexj6h1HN81C6+lP2Tmpaj+fl3/wOizzA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "10.75.0",
+        "@sentry/replay": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@tailwindcss/node": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
@@ -1493,9 +1588,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1512,9 +1604,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1531,9 +1620,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1550,9 +1636,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1663,6 +1746,12 @@
         "react": "^18 || ^19"
       }
     },
+    "node_modules/@types/css-font-loading-module": {
+      "version": "0.0.7",
+      "resolved": "https://registry.npmjs.org/@types/css-font-loading-module/-/css-font-loading-module-0.0.7.tgz",
+      "integrity": "sha512-nl09VhutdjINdWyXxHWN/w9zlNCfr60JUqJbd24YXUuCwgeL0TpFSdElCwb6cxfB6ybE19Gjj4g0jsgkXxKv1Q==",
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "24.13.3",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
@@ -1719,6 +1808,12 @@
         }
       }
     },
+    "node_modules/@xstate/fsm": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/@xstate/fsm/-/fsm-1.6.5.tgz",
+      "integrity": "sha512-b5o1I6aLNeYlU/3CPlj/Z91ybk1gUsKT+5NAJI+2W4UjvS5KLG28K9v5UvNoFVjHV8PajVZ00RH3vnjyQO7ZAw==",
+      "license": "MIT"
+    },
     "node_modules/aria-hidden": {
       "version": "1.2.6",
       "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
@@ -1731,6 +1826,15 @@
         "node": ">=10"
       }
     },
+    "node_modules/base64-arraybuffer": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz",
+      "integrity": "sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
     "node_modules/class-variance-authority": {
       "version": "0.7.1",
       "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
@@ -1991,9 +2095,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2014,9 +2115,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2037,9 +2135,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2060,9 +2155,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2134,6 +2226,12 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/mitt": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/mitt/-/mitt-3.0.1.tgz",
+      "integrity": "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==",
+      "license": "MIT"
+    },
     "node_modules/nanoid": {
       "version": "3.3.18",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
@@ -2423,6 +2521,40 @@
         "@rolldown/binding-win32-x64-msvc": "1.2.3"
       }
     },
+    "node_modules/rrdom": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/rrdom/-/rrdom-2.1.6.tgz",
+      "integrity": "sha512-EMRrTs1GRsmb8bNyAs107wG7eRwVEOvDUBsnCyvQnVV6elrmrua/AeS0tdcA0gLW4eptr4l6bRsS/2QRICvdqQ==",
+      "license": "MIT",
+      "dependencies": {
+        "rrweb-snapshot": "^2.1.6"
+      }
+    },
+    "node_modules/rrweb": {
+      "version": "2.0.0-alpha.20",
+      "resolved": "https://registry.npmjs.org/rrweb/-/rrweb-2.0.0-alpha.20.tgz",
+      "integrity": "sha512-CZKDlm+j1VA50Ko3gnMbpvguCAleljsTNXPnVk9aeNP8o6T6kolRbISHyDZpqZ4G+bdDLlQOignPP3jEsXs8Gg==",
+      "license": "MIT",
+      "dependencies": {
+        "@rrweb/types": "^2.0.0-alpha.20",
+        "@rrweb/utils": "^2.0.0-alpha.20",
+        "@types/css-font-loading-module": "0.0.7",
+        "@xstate/fsm": "^1.4.0",
+        "base64-arraybuffer": "^1.0.1",
+        "mitt": "^3.0.0",
+        "rrdom": "^2.0.0-alpha.20",
+        "rrweb-snapshot": "^2.0.0-alpha.20"
+      }
+    },
+    "node_modules/rrweb-snapshot": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/rrweb-snapshot/-/rrweb-snapshot-2.1.6.tgz",
+      "integrity": "sha512-X03+x3AdWTbpD4Swb54CCJoEauYTv/O2ah0d3ZVv5rgr6bv0Ty5mxNjEyEEfNC1dQ8VdyjKKJgDG3A00FV0lNg==",
+      "license": "MIT",
+      "dependencies": {
+        "postcss": "^8.4.38"
+      }
+    },
     "node_modules/scheduler": {
       "version": "0.27.0",
       "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
@@ -2788,9 +2920,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2811,9 +2940,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2834,9 +2960,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2857,9 +2980,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [

frontend/package.json

@@ -10,9 +10,11 @@
     "preview": "vite preview"
   },
   "dependencies": {
+    "@sentry/react": "^10.0.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/utilities": "^3.2.2",
     "@hookform/resolvers": "3.10",
+    "@openpanel/web": "^1.0.1",
     "@radix-ui/react-checkbox": "^1.3.11",
     "@radix-ui/react-dialog": "^1.1.23",
     "@radix-ui/react-label": "^2.1.15",

frontend/src/App.tsx

@@ -1,8 +1,9 @@
 import { lazy, Suspense } from "react";
 import { Navigate, Route, Routes } from "react-router-dom";
 import { useAuthStore } from "./store/auth";
-import { MobileTabBar } from "./components/layout/MobileTabBar";
 import { ErrorBoundary } from "./components/ErrorBoundary";
+import { RequirePmProjects } from "./components/RequirePmProjects";
+import { MobileTabBar } from "./components/layout/MobileTabBar";
 
 // هر صفحه با React.lazy لود می‌شود (code splitting)
 const DashboardPage = lazy(() =>
@@ -142,7 +143,9 @@ export default function App() {
           path="/inventory"
           element={
             <RequireAuth>
-              <InventoryPage />
+              <RequirePmProjects>
+                <InventoryPage />
+              </RequirePmProjects>
             </RequireAuth>
           }
         />
@@ -150,7 +153,9 @@ export default function App() {
           path="/inventory/arrivals"
           element={
             <RequireAuth>
-              <ArrivalsPage />
+              <RequirePmProjects>
+                <ArrivalsPage />
+              </RequirePmProjects>
             </RequireAuth>
           }
         />
@@ -158,7 +163,9 @@ export default function App() {
           path="/inventory/change"
           element={
             <RequireAuth>
-              <ChangeInventoryPage />
+              <RequirePmProjects>
+                <ChangeInventoryPage />
+              </RequirePmProjects>
             </RequireAuth>
           }
         />
@@ -166,7 +173,9 @@ export default function App() {
           path="/inventory/daily"
           element={
             <RequireAuth>
-              <DailyControlPage />
+              <RequirePmProjects>
+                <DailyControlPage />
+              </RequirePmProjects>
             </RequireAuth>
           }
         />
@@ -174,7 +183,9 @@ export default function App() {
           path="/inventory/warehouses"
           element={
             <RequireAuth>
-              <WarehousesPage />
+              <RequirePmProjects>
+                <WarehousesPage />
+              </RequirePmProjects>
             </RequireAuth>
           }
         />
@@ -182,7 +193,9 @@ export default function App() {
           path="/inventory/org"
           element={
             <RequireAuth>
-              <OrganizationPage />
+              <RequirePmProjects>
+                <OrganizationPage />
+              </RequirePmProjects>
             </RequireAuth>
           }
         />

frontend/src/components/AppSwitcherMenu.tsx

@@ -1,9 +1,14 @@
-import { PanelMenu } from "./PanelMenu";
+import { useLocation } from "react-router-dom";
+import { PanelMenu, type MenuItem } from "./PanelMenu";
 import { useLogout } from "../pages/Inventory/panelMenu";
+import { useAuthStore } from "../store/auth";
 
 // منوی همبرگری مشترک بین دو ماژول (پنل انبار / دفتر تدارکات) —
 // دقیقاً مثل منوی دفتر: عنوان «پنل‌ها»، ماژول فعلی با استایل فعال (پر)
 // + «✓ فعلی»، ماژول دیگر به‌عنوان سوییچر، و در پایان جداکننده + خروج.
+// مدیر پروژه (1:N): زیر «مدیریت انبار» یک آکاردئون باز می‌شود که همه‌ی
+// پروژه‌های تخصیص‌یافته را نشان می‌دهد؛ پروژه‌ی فعال با «✓ فعلی» مشخص است و
+// انتخاب هر پروژه فقط «پروژه‌ی فعال» را عوض می‌کند (نشست/توکن دست‌نخورده).
 export function AppSwitcherMenu({
   activeModule,
   canSwitchToProcurement = true,
@@ -12,13 +17,28 @@ export function AppSwitcherMenu({
   canSwitchToProcurement?: boolean; // مدیر پروژه به دفتر تدارکات دسترسی ندارد
 }) {
   const logout = useLogout();
-  const items = [];
+  const { pathname } = useLocation();
+  const user = useAuthStore((s) => s.user);
+  const setActiveProject = useAuthStore((s) => s.setActiveProject);
+  const items: MenuItem[] = [];
+
+  const isPm = user?.role === "pm";
+  const pmProjects = isPm ? user?.projects ?? [] : [];
+  const projectChildren: MenuItem[] | undefined =
+    activeModule === "warehouse" && isPm
+      ? pmProjects.map((p) => ({
+          label: p.name,
+          to: pathname, // همان بخش فعلی؛ فقط پروژه عوض می‌شود
+          active: p.id === user?.project_id,
+          onClick: () => setActiveProject(p.id),
+        }))
+      : undefined;
 
   if (activeModule === "procurement") {
     items.push({ label: "مدیریت انبار", to: "/inventory" });
     items.push({ label: "مدیریت تدارکات", to: "/", active: true });
   } else {
-    items.push({ label: "مدیریت انبار", to: "/inventory", active: true });
+    items.push({ label: "مدیریت انبار", to: "/inventory", active: true, children: projectChildren });
     if (canSwitchToProcurement) {
       items.push({ label: "مدیریت تدارکات", to: "/" });
     }

frontend/src/components/ErrorBoundary.tsx

@@ -1,4 +1,5 @@
 import { Component, type ErrorInfo, type ReactNode } from "react";
+import { captureError } from "../lib/analytics";
 
 interface Props {
   children: ReactNode;
@@ -19,6 +20,8 @@ export class ErrorBoundary extends Component<Props, State> {
 
   componentDidCatch(error: Error, info: ErrorInfo) {
     console.error("ErrorBoundary caught:", error, info);
+    // GlitchTip/Sentry (no-op بدون VITE_SENTRY_DSN)
+    captureError(error);
   }
 
   private retry = () => {

frontend/src/components/FileList.tsx

@@ -9,13 +9,13 @@ export interface FileListProps {
   upload: (file: File) => Promise<Attachment>;
   // حذف سمت سرور (اختیاری — بعد از حذف محلی صدا زده می‌شود)
   onDelete?: (a: Attachment) => void;
-  // لینک دانلود؛ null یعنی هنوز آپلود نشده
-  urlOf?: (a: Attachment) => string | null;
+  // دانلود احراز هویت‌شده (توکن Bearer + blob — لینک خام توکن نمی‌فرستد)
+  onDownload?: (a: Attachment) => void | Promise<void>;
   label?: string;
 }
 
 // مدیریت چند فاکتور: آپلود مستقیم به سرور (MinIO) + دانلود/حذف فایل‌های ذخیره‌شده
-export function FileList({ files, onChange, upload, onDelete, urlOf, label = "افزودن فاکتور" }: FileListProps) {
+export function FileList({ files, onChange, upload, onDelete, onDownload, label = "افزودن فاکتور" }: FileListProps) {
   const inputRef = useRef<HTMLInputElement | null>(null);
 
   const remove = (i: number) => {
@@ -45,10 +45,19 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
       {files.map((inv, i) => (
         <div key={i} className="inv-row">
           <span className="inv-name">📎 {inv.name}</span>
-          {urlOf?.(inv) && (
-            <a className="inv-open" href={urlOf(inv)!} download={inv.name} title="دانلود">
+          {onDownload && (
+            <button
+              type="button"
+              className="inv-open"
+              title="دانلود"
+              onClick={() => {
+                Promise.resolve(onDownload(inv)).catch((err) =>
+                  toast.error(err instanceof Error ? err.message : "دانلود فایل ناموفق بود"),
+                );
+              }}
+            >
               ↓
-            </a>
+            </button>
           )}
           <button type="button" className="inv-x" title="حذف" onClick={() => remove(i)}>
             ×

frontend/src/components/JalaliDatePicker.tsx

@@ -1,4 +1,4 @@
-import { useMemo, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import {
   daysInMonth,
   gregorianToJalali,
@@ -6,6 +6,7 @@ import {
   jalaliStrToIso,
   jalaliToGregorian,
   MONTHS,
+  toAsciiDigits,
   toFa,
   WEEKDAYS,
 } from "../lib/jalali";
@@ -14,11 +15,12 @@ import { cn } from "../lib/utils";
 import { useClickOutside } from "./useClickOutside";
 
 export interface JalaliDatePickerProps {
-  value: string | null; // ISO date (با time اختیاری)
-  onChange: (iso: string | null) => void;
+  value: string | null; // ISO date (یا YYYY-MM-DD با time اختیاری)
+  onChange: (val: string | null) => void;
   placeholder?: string;
   className?: string;
   withTime?: boolean; // نمایش ساعت:دقیقه هم (پیشنهاد/پذیرش/رسید)
+  disabled?: boolean;
 }
 
 function todayJalali(): [number, number, number] {
@@ -28,6 +30,13 @@ function todayJalali(): [number, number, number] {
 
 function isoToJalali(iso: string | null): [number, number, number] | null {
   if (!iso) return null;
+  const m = String(iso).match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  if (m) {
+    const gy = parseInt(m[1], 10);
+    const gm = parseInt(m[2], 10);
+    const gd = parseInt(m[3], 10);
+    return gregorianToJalali(gy, gm, gd);
+  }
   const d = new Date(iso);
   if (Number.isNaN(d.getTime())) return null;
   return gregorianToJalali(d.getFullYear(), d.getMonth() + 1, d.getDate());
@@ -39,6 +48,12 @@ function buildIso(jy: number, jm: number, jd: number, h: number, m: number): str
   return new Date(gy, gm - 1, gd, h, m).toISOString();
 }
 
+// ساخت تاریخ استاندارد YYYY-MM-DD بدون مؤلفه زمان
+function buildDateOnly(jy: number, jm: number, jd: number): string {
+  const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
+  return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+}
+
 // وقتی هنوز زمان مشخصی ست نشده، ساعت/دقیقه‌ی فعلی سیستم پیش‌فرض است
 // (نه ۰۰:۰۰) — دکمه‌ی «امروز» و انتخاب روز، همین زمان را نگه می‌دارند.
 function nowTime(): { h: number; m: number } {
@@ -60,9 +75,14 @@ export function JalaliDatePicker({
   placeholder,
   className,
   withTime = false,
+  disabled = false,
 }: JalaliDatePickerProps) {
   const [open, setOpen] = useState(false);
   const [curJ, setCurJ] = useState<[number, number, number]>(() => isoToJalali(value) ?? todayJalali());
+  const initialTime = timeOf(value);
+  const [hourText, setHourText] = useState<string>(() => faNum(String(initialTime.h).padStart(2, "0")));
+  const [minuteText, setMinuteText] = useState<string>(() => faNum(String(initialTime.m).padStart(2, "0")));
+
   const [text, setText] = useState<string>(() => {
     if (!value) return "";
     const j = isoToJalaliStr(value);
@@ -74,17 +94,49 @@ export function JalaliDatePicker({
     return `${j} ${faNum(hh + ":" + mm)}`;
   });
 
+  useEffect(() => {
+    if (!value) {
+      setText("");
+      const now = nowTime();
+      setHourText(faNum(String(now.h).padStart(2, "0")));
+      setMinuteText(faNum(String(now.m).padStart(2, "0")));
+      return;
+    }
+    const j = isoToJalaliStr(value);
+    const t = timeOf(value);
+    if (!withTime) {
+      setText(j);
+    } else {
+      const hh = String(t.h).padStart(2, "0");
+      const mm = String(t.m).padStart(2, "0");
+      setText(`${j} ${faNum(hh + ":" + mm)}`);
+
+      // Only update local input texts if numeric values differ, to avoid wiping in-progress typing
+      const curH = parseInt(toAsciiDigits(hourText) || "0", 10);
+      if (curH !== t.h) {
+        setHourText(faNum(hh));
+      }
+      const curM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+      if (curM !== t.m) {
+        setMinuteText(faNum(mm));
+      }
+    }
+    const jParts = isoToJalali(value);
+    if (jParts) setCurJ(jParts);
+  }, [value, withTime]);
+
   const ref = useClickOutside<HTMLDivElement>(() => setOpen(false));
 
   // تاریخ انتخاب‌شده به صورت محلی (نه UTC) برای مقایسه با سلول‌های تقویم
   function selectedLocalDate(): string | null {
     if (!value) return null;
+    const m = String(value).match(/^(\d{4})-(\d{2})-(\d{2})$/);
+    if (m) return `${m[1]}-${m[2]}-${m[3]}`;
     const d = new Date(value);
     if (Number.isNaN(d.getTime())) return null;
     return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
   }
   const selectedIso = selectedLocalDate();
-  const time = timeOf(value);
 
   const grid = useMemo(() => {
     const [jy, jm] = curJ;
@@ -124,35 +176,108 @@ export function JalaliDatePicker({
   };
 
   const selectDay = (jy: number, jm: number, jd: number) => {
-    const isoWithTime = buildIso(jy, jm, jd, time.h, time.m);
-    onChange(isoWithTime);
-    setText(`${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}${withTime ? " " + faNum(String(time.h).padStart(2, "0") + ":" + String(time.m).padStart(2, "0")) : ""}`);
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    const validM = Math.min(59, Math.max(0, currentM));
+    const val = withTime ? buildIso(jy, jm, jd, validH, validM) : buildDateOnly(jy, jm, jd);
+    onChange(val);
+    setText(
+      `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}${withTime ? " " + faNum(String(validH).padStart(2, "0") + ":" + String(validM).padStart(2, "0")) : ""}`
+    );
     setOpen(false);
   };
 
-  const setTimePart = (part: "h" | "m", raw: string) => {
-    const n = parseInt(raw.replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))), 10);
-    if (Number.isNaN(n)) return;
-    const h = part === "h" ? Math.min(23, Math.max(0, n)) : time.h;
-    const m = part === "m" ? Math.min(59, Math.max(0, n)) : time.m;
+  const handleHourChange = (raw: string) => {
+    let digits = toAsciiDigits(raw).replace(/\D/g, "");
+    if (digits.length === 3) {
+      digits = digits.slice(-1);
+    } else if (digits.length > 3) {
+      digits = digits.slice(0, 2);
+    }
+    if (!digits) {
+      setHourText("");
+      return;
+    }
+    const n = parseInt(digits, 10);
+    const clamped = Math.min(23, Math.max(0, n));
+    const textToShow = digits.length === 2 && n > 23 ? String(clamped) : digits;
+    setHourText(faNum(textToShow));
+
     const [jy, jm, jd] = curJ;
-    onChange(buildIso(jy, jm, jd, h, m));
-    // به‌روزرسانی نمایش
-    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, h, m));
-    setText(`${j} ${faNum(String(h).padStart(2, "0") + ":" + String(m).padStart(2, "0"))}`);
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validM = Math.min(59, Math.max(0, currentM));
+    onChange(buildIso(jy, jm, jd, clamped, validM));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, clamped, validM));
+    setText(`${j} ${faNum(String(clamped).padStart(2, "0") + ":" + String(validM).padStart(2, "0"))}`);
+  };
+
+  const handleHourBlur = () => {
+    const digits = toAsciiDigits(hourText).replace(/\D/g, "");
+    const n = digits ? parseInt(digits, 10) : 0;
+    const clamped = Math.min(23, Math.max(0, n));
+    setHourText(faNum(String(clamped).padStart(2, "0")));
+
+    const [jy, jm, jd] = curJ;
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validM = Math.min(59, Math.max(0, currentM));
+    onChange(buildIso(jy, jm, jd, clamped, validM));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, clamped, validM));
+    setText(`${j} ${faNum(String(clamped).padStart(2, "0") + ":" + String(validM).padStart(2, "0"))}`);
+  };
+
+  const handleMinuteChange = (raw: string) => {
+    let digits = toAsciiDigits(raw).replace(/\D/g, "");
+    if (digits.length === 3) {
+      digits = digits.slice(-1);
+    } else if (digits.length > 3) {
+      digits = digits.slice(0, 2);
+    }
+    if (!digits) {
+      setMinuteText("");
+      return;
+    }
+    const n = parseInt(digits, 10);
+    const clamped = Math.min(59, Math.max(0, n));
+    const textToShow = digits.length === 2 && n > 59 ? String(clamped) : digits;
+    setMinuteText(faNum(textToShow));
+
+    const [jy, jm, jd] = curJ;
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    onChange(buildIso(jy, jm, jd, validH, clamped));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, validH, clamped));
+    setText(`${j} ${faNum(String(validH).padStart(2, "0") + ":" + String(clamped).padStart(2, "0"))}`);
+  };
+
+  const handleMinuteBlur = () => {
+    const digits = toAsciiDigits(minuteText).replace(/\D/g, "");
+    const n = digits ? parseInt(digits, 10) : 0;
+    const clamped = Math.min(59, Math.max(0, n));
+    setMinuteText(faNum(String(clamped).padStart(2, "0")));
+
+    const [jy, jm, jd] = curJ;
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    onChange(buildIso(jy, jm, jd, validH, clamped));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, validH, clamped));
+    setText(`${j} ${faNum(String(validH).padStart(2, "0") + ":" + String(clamped).padStart(2, "0"))}`);
   };
 
   const pickToday = () => {
     const now = new Date();
     const [jy, jm, jd] = todayJalali();
-    // بدون withTime فقط تاریخ امروز ثبت می‌شود — ساعت همیشه نیمه‌شب
-    const isoWithTime = withTime
-      ? buildIso(jy, jm, jd, now.getHours(), now.getMinutes())
-      : buildIso(jy, jm, jd, 0, 0);
-    onChange(isoWithTime);
+    const nh = now.getHours();
+    const nm = now.getMinutes();
+    setHourText(faNum(String(nh).padStart(2, "0")));
+    setMinuteText(faNum(String(nm).padStart(2, "0")));
+    const val = withTime
+      ? buildIso(jy, jm, jd, nh, nm)
+      : buildDateOnly(jy, jm, jd);
+    onChange(val);
     setText(
       withTime
-        ? `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))} ${faNum(String(now.getHours()).padStart(2, "0") + ":" + String(now.getMinutes()).padStart(2, "0"))}`
+        ? `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))} ${faNum(String(nh).padStart(2, "0") + ":" + String(nm).padStart(2, "0"))}`
         : `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}`,
     );
     setOpen(false);
@@ -161,32 +286,98 @@ export function JalaliDatePicker({
   const clear = () => {
     onChange(null);
     setText("");
+    const now = nowTime();
+    setHourText(faNum(String(now.h).padStart(2, "0")));
+    setMinuteText(faNum(String(now.m).padStart(2, "0")));
     setOpen(false);
   };
 
   const onInputChange = (v: string) => {
     setText(v);
+    if (!v.trim()) {
+      onChange(null);
+      return;
+    }
     const iso = jalaliStrToIso(v);
     if (iso) {
-      onChange(iso);
+      if (!withTime) {
+        const nums = String(v)
+          .split(/[/\-.]/)
+          .map((x) => parseInt(toAsciiDigits(x), 10));
+        if (nums.length >= 3 && !nums.some((n) => Number.isNaN(n))) {
+          const [gy, gm, gd] = jalaliToGregorian(nums[0], nums[1], nums[2]);
+          onChange(`${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`);
+        } else {
+          onChange(iso.slice(0, 10));
+        }
+      } else {
+        onChange(iso);
+      }
       const j = isoToJalali(iso);
       if (j) setCurJ([j[0], j[1], j[2]]);
     }
   };
 
+  const handleInputBlur = () => {
+    if (!text.trim()) {
+      onChange(null);
+      return;
+    }
+    const iso = jalaliStrToIso(text);
+    if (iso) {
+      if (!withTime) {
+        const nums = String(text)
+          .split(/[/\-.]/)
+          .map((x) => parseInt(toAsciiDigits(x), 10));
+        if (nums.length >= 3 && !nums.some((n) => Number.isNaN(n))) {
+          const [gy, gm, gd] = jalaliToGregorian(nums[0], nums[1], nums[2]);
+          const dOnly = `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+          onChange(dOnly);
+          setText(isoToJalaliStr(dOnly));
+        } else {
+          onChange(iso.slice(0, 10));
+          setText(isoToJalaliStr(iso));
+        }
+      } else {
+        onChange(iso);
+        const j = isoToJalaliStr(iso);
+        const d = new Date(iso);
+        if (!Number.isNaN(d.getTime())) {
+          const hh = String(d.getHours()).padStart(2, "0");
+          const mm = String(d.getMinutes()).padStart(2, "0");
+          setText(`${j} ${faNum(hh + ":" + mm)}`);
+        }
+      }
+    } else if (value) {
+      const j = isoToJalaliStr(value);
+      if (!withTime) {
+        setText(j);
+      } else {
+        const d = new Date(value);
+        if (!Number.isNaN(d.getTime())) {
+          const hh = String(d.getHours()).padStart(2, "0");
+          const mm = String(d.getMinutes()).padStart(2, "0");
+          setText(`${j} ${faNum(hh + ":" + mm)}`);
+        }
+      }
+    }
+  };
+
   return (
     <div ref={ref} className={cn("relative", className)}>
       <input
         type="text"
-        className="flex h-9 w-full rounded-md border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+        disabled={disabled}
+        className="flex h-9 w-full rounded-md border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
         value={text}
         placeholder={placeholder ?? "۱۴۰۳/۰۵/۱۲"}
         autoComplete="off"
-        onFocus={() => setOpen(true)}
-        onClick={() => setOpen(true)}
+        onFocus={() => !disabled && setOpen(true)}
+        onClick={() => !disabled && setOpen(true)}
         onChange={(e) => onInputChange(e.target.value)}
+        onBlur={handleInputBlur}
       />
-      {open && (
+      {open && !disabled && (
         <div
           className={cn(
             "absolute inset-x-0 top-full z-30 mt-1 rounded-md border border-line bg-panel shadow-md",
@@ -195,6 +386,7 @@ export function JalaliDatePicker({
             withTime ? "w-80 p-3" : "w-64 p-2",
           )}
         >
+          {/* 1. Header: Month / Year Navigation */}
           <div className="mb-1.5 flex items-center justify-between gap-1">
             <button type="button" className="cursor-pointer rounded px-1.5 text-sm hover:bg-slate-bg" onClick={() => nav("y+1")}>
               «
@@ -212,6 +404,8 @@ export function JalaliDatePicker({
               »
             </button>
           </div>
+
+          {/* 2. Day of Week Header & Days Grid */}
           <div className="grid grid-cols-7 gap-0.5 text-center">
             {WEEKDAYS.map((w) => (
               <div key={w} className="py-0.5 text-[10px] font-bold text-muted">
@@ -238,33 +432,40 @@ export function JalaliDatePicker({
               ),
             )}
           </div>
+
+          {/* 3. Time Inputs Row (Positioned BELOW the calendar grid) — Hour on left, Minute on right */}
           {withTime && (
-            <div className="mt-2 flex items-center justify-center gap-4 border-t border-line pt-2.5">
+            <div className="mt-2 flex items-center justify-center gap-3 rounded-md border border-line/70 bg-slate-bg/40 py-1.5">
               <div className="flex items-center gap-1.5">
-                <span className="text-[11.5px] font-semibold text-muted">ساعت</span>
                 <input
                   type="text"
-                  className="num-input h-8 w-14 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-10 max-md:w-16"
-                  value={faNum(String(time.h).padStart(2, "0"))}
+                  className="num-input h-7 w-12 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-9 max-md:w-14"
+                  value={minuteText}
                   inputMode="numeric"
-                  maxLength={2}
-                  onChange={(e) => setTimePart("h", e.target.value)}
+                  onFocus={(e) => e.target.select()}
+                  onChange={(e) => handleMinuteChange(e.target.value)}
+                  onBlur={handleMinuteBlur}
                 />
-              </div>
-              <span className="text-muted">:</span>
-              <div className="flex items-center gap-1.5">
                 <span className="text-[11.5px] font-semibold text-muted">دقیقه</span>
+              </div>
+              <span className="font-bold text-muted">:</span>
+              <div className="flex items-center gap-1.5">
                 <input
                   type="text"
-                  className="num-input h-8 w-14 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-10 max-md:w-16"
-                  value={faNum(String(time.m).padStart(2, "0"))}
+                  className="num-input h-7 w-12 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-9 max-md:w-14"
+                  value={hourText}
                   inputMode="numeric"
-                  maxLength={2}
-                  onChange={(e) => setTimePart("m", e.target.value)}
+                  onFocus={(e) => e.target.select()}
+                  onChange={(e) => handleHourChange(e.target.value)}
+                  onBlur={handleHourBlur}
                 />
+                <span className="text-[11.5px] font-semibold text-muted">ساعت</span>
               </div>
             </div>
           )}
+
+
+          {/* 4. Action Buttons Footer */}
           <div className="mt-2 flex justify-between border-t border-line pt-2">
             <button type="button" className="cursor-pointer rounded px-2 py-0.5 text-[11.5px] text-accent hover:bg-slate-bg" onClick={pickToday}>
               امروز

frontend/src/components/MilestoneRow.tsx

@@ -6,10 +6,11 @@ export interface MilestoneRowProps {
   milestone: Milestone;
   onChange: (m: Milestone) => void;
   onRemove: () => void;
+  disabled?: boolean;
 }
 
 // یک ردیف مرحله‌ی پرداخت: تاریخ + مبلغ + دکمه‌ی حذف
-export function MilestoneRow({ milestone, onChange, onRemove }: MilestoneRowProps) {
+export function MilestoneRow({ milestone, onChange, onRemove, disabled = false }: MilestoneRowProps) {
   return (
     <div className="milestone-row">
       <JalaliDatePicker
@@ -17,6 +18,7 @@ export function MilestoneRow({ milestone, onChange, onRemove }: MilestoneRowProp
         onChange={(iso) => onChange({ ...milestone, when_iso: iso })}
         placeholder="تاریخ"
         className="w-36 shrink-0"
+        disabled={disabled}
       />
       <div className="ms-amount-wrap">
         <NumberInput
@@ -24,11 +26,14 @@ export function MilestoneRow({ milestone, onChange, onRemove }: MilestoneRowProp
           onChange={(amount) => onChange({ ...milestone, amount })}
           placeholder="مبلغ (تومان)"
           showWords
+          disabled={disabled}
         />
       </div>
-      <button type="button" className="ms-x" title="حذف" onClick={onRemove}>
-        ×
-      </button>
+      {!disabled && (
+        <button type="button" className="ms-x" title="حذف" onClick={onRemove}>
+          ×
+        </button>
+      )}
     </div>
   );
 }

frontend/src/components/MultiSelectCombobox.tsx

@@ -12,6 +12,7 @@ export interface MultiSelectComboboxProps {
   className?: string;
   inputClassName?: string;
   allowCreate?: boolean; // اجازه‌ی تایپ مقدار جدید (پیش‌فرض true)
+  disabled?: boolean;
 }
 
 // چند-انتخابی خلاق (creatable multi-select) با چیپ‌ها:
@@ -27,6 +28,7 @@ export function MultiSelectCombobox({
   className,
   inputClassName,
   allowCreate = true,
+  disabled = false,
 }: MultiSelectComboboxProps) {
   const [text, setText] = useState("");
   const [open, setOpen] = useState(false);
@@ -105,46 +107,56 @@ export function MultiSelectCombobox({
   return (
     <div ref={ref} className={cn("relative", className)}>
       <div
-        className="flex min-h-9 w-full flex-wrap items-center gap-1 rounded-lg border border-line bg-panel px-2 py-1 shadow-sm transition-colors focus-within:ring-2 focus-within:ring-accent/40"
-        onClick={() => inputRef.current?.focus()}
+        className={cn(
+          "flex min-h-9 w-full flex-wrap items-center gap-1 rounded-lg border border-line bg-panel px-2 py-1 shadow-sm transition-colors focus-within:ring-2 focus-within:ring-accent/40",
+          disabled && "cursor-not-allowed opacity-60 bg-canvas/40",
+        )}
+        onClick={() => !disabled && inputRef.current?.focus()}
       >
         {values.map((v) => (
           <span key={v} className="spec-chip">
             <span className="max-w-[140px] truncate">{v}</span>
-            <button
-              type="button"
-              className="spec-chip-x"
-              title="حذف"
-              onClick={(e) => {
-                e.stopPropagation();
-                setPendingRemove(v);
-              }}
-            >
-              ×
-            </button>
+            {!disabled && (
+              <button
+                type="button"
+                className="spec-chip-x"
+                title="حذف"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  setPendingRemove(v);
+                }}
+              >
+                ×
+              </button>
+            )}
           </span>
         ))}
         <input
           ref={inputRef}
           type="text"
+          disabled={disabled}
           className={cn(
-            "min-w-[80px] flex-1 border-0 bg-transparent px-0.5 py-0.5 text-[12px] text-ink caret-accent outline-none placeholder:text-muted",
+            "min-w-[80px] flex-1 border-0 bg-transparent px-0.5 py-0.5 text-[12px] text-ink caret-accent outline-none placeholder:text-muted disabled:cursor-not-allowed",
             inputClassName,
           )}
           value={text}
           placeholder={values.length ? "" : placeholder}
           autoComplete="off"
           onChange={(e) => {
+            if (disabled) return;
             setText(e.target.value);
             setHighlight(-1);
             setOpen(true);
           }}
-          onFocus={() => setOpen(true)}
-          onKeyDown={onKeyDown}
+          onFocus={() => !disabled && setOpen(true)}
+          onKeyDown={(e) => {
+            if (disabled) return;
+            onKeyDown(e);
+          }}
         />
       </div>
 
-      {open && (
+      {open && !disabled && (
         <div className="absolute inset-x-0 top-full z-30 mt-1 max-h-56 overflow-y-auto rounded-lg border border-line bg-panel py-1 shadow-lg">
           {listCount === 0 && (
             <div className="px-3 py-1.5 text-[12px] text-muted">

frontend/src/components/NumberInput.tsx

@@ -10,6 +10,7 @@ export interface NumberInputProps {
   showWords?: boolean; // نمایش معادل فارسی زیر input
   inputMode?: "numeric" | "decimal" | undefined;
   maxDecimals?: number; // حداکثر رقم اعشار (مثلاً ۲ برای قیمت واحد)
+  disabled?: boolean;
 }
 
 // ورودی عددی با فرمت‌دهی خودکار (groupCommas) و نمایش کلمات فارسی
@@ -21,6 +22,7 @@ export function NumberInput({
   showWords = false,
   inputMode = "numeric",
   maxDecimals,
+  disabled = false,
 }: NumberInputProps) {
   // فرمت با رعایت حداکثر اعشار (گرد کردن)
   const formatValue = (n: number): string => {
@@ -62,7 +64,8 @@ export function NumberInput({
     <div className={cn("min-w-0", className)}>
       <input
         type="text"
-        className="num-input h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+        disabled={disabled}
+        className="num-input h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
         value={text}
         placeholder={placeholder}
         inputMode={inputMode}

frontend/src/components/PanelMenu.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useRef, useState } from "react";
 import { Link } from "react-router-dom";
-import { Menu, X } from "lucide-react";
+import { ChevronDown, Menu, X } from "lucide-react";
 import { cn } from "../lib/utils";
 
 export interface MenuItem {
@@ -9,11 +9,14 @@ export interface MenuItem {
   active?: boolean;
   divider?: boolean;
   onClick?: () => void;
+  // آیتم بازشو (آکاردئونی) — مثلاً فهرست پروژه‌های مدیر پروژه زیر «مدیریت انبار»
+  children?: MenuItem[];
 }
 
 // منوی همبرگری — بالای راست صفحات؛ نمایش پنل فعلی + ناوبری بین پنل‌ها
 export function PanelMenu({ items, title }: { items: MenuItem[]; title?: string }) {
   const [open, setOpen] = useState(false);
+  const [expanded, setExpanded] = useState<number | null>(null);
   const ref = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
@@ -42,11 +45,81 @@ export function PanelMenu({ items, title }: { items: MenuItem[]; title?: string
           {items.map((it, i) =>
             it.divider ? (
               <div key={i} className="my-1 border-t border-line" />
+            ) : it.children?.length ? (
+              <div key={i}>
+                <div className={cn("flex items-center rounded-lg", it.active && "bg-accent")}>
+                  {it.to ? (
+                    <Link
+                      to={it.to}
+                      onClick={() => {
+                        setOpen(false);
+                        it.onClick?.();
+                      }}
+                      className={cn(
+                        "flex flex-1 items-center justify-between gap-3 rounded-lg px-3 py-2 text-[13px] no-underline",
+                        it.active ? "font-bold text-white" : "text-ink hover:bg-slate-bg",
+                      )}
+                    >
+                      {it.label}
+                      {it.active && <span className="text-[10px] opacity-80">✓ فعلی</span>}
+                    </Link>
+                  ) : (
+                    <button
+                      type="button"
+                      onClick={() => {
+                        setOpen(false);
+                        it.onClick?.();
+                      }}
+                      className="flex flex-1 items-center gap-3 rounded-lg px-3 py-2 text-start text-[13px] text-ink hover:bg-slate-bg"
+                    >
+                      {it.label}
+                    </button>
+                  )}
+                  <button
+                    type="button"
+                    aria-label={expanded === i ? "بستن فهرست پروژه‌ها" : "نمایش پروژه‌ها"}
+                    aria-expanded={expanded === i}
+                    onClick={() => setExpanded(expanded === i ? null : i)}
+                    className={cn(
+                      "me-1 inline-flex h-7 w-7 shrink-0 cursor-pointer items-center justify-center rounded-md",
+                      it.active ? "text-white hover:bg-white/15" : "text-muted hover:bg-slate-bg",
+                    )}
+                  >
+                    <ChevronDown
+                      className={cn("h-4 w-4 transition-transform", expanded === i && "rotate-180")}
+                    />
+                  </button>
+                </div>
+                {expanded === i && (
+                  <div className="mt-0.5 flex flex-col gap-0.5 border-s border-line ps-2 ms-3">
+                    {it.children.map((c, j) => (
+                      <Link
+                        key={j}
+                        to={c.to ?? "#"}
+                        onClick={() => {
+                          setOpen(false);
+                          c.onClick?.();
+                        }}
+                        className={cn(
+                          "flex items-center justify-between gap-2 rounded-lg px-2.5 py-1.5 text-[12.5px] no-underline",
+                          c.active ? "bg-accent-bg font-bold text-accent" : "text-ink hover:bg-slate-bg",
+                        )}
+                      >
+                        <span className="truncate">{c.label}</span>
+                        {c.active && <span className="shrink-0 text-[10px]">✓ فعلی</span>}
+                      </Link>
+                    ))}
+                  </div>
+                )}
+              </div>
             ) : it.to ? (
               <Link
                 key={i}
                 to={it.to}
-                onClick={() => setOpen(false)}
+                onClick={() => {
+                  setOpen(false);
+                  it.onClick?.();
+                }}
                 className={cn(
                   "flex items-center justify-between gap-3 rounded-lg px-3 py-2 text-[13px] no-underline",
                   it.active ? "bg-accent font-bold text-white" : "text-ink hover:bg-slate-bg",

frontend/src/components/ProjectMultiSelect.tsx

@@ -0,0 +1,129 @@
+import { useMemo, useRef, useState } from "react";
+import { X } from "lucide-react";
+import { normalize } from "../lib/normalize";
+import { cn } from "../lib/utils";
+import { useClickOutside } from "./useClickOutside";
+
+export interface ProjectOption {
+  id: string;
+  name: string;
+}
+
+// چند-انتخابیِ جست‌وجوپذیرِ پروژه‌ها (1:N — مدیر پروژه ↔ پروژه‌ها):
+//  - چیپ‌های پروژه با دکمه‌ی × (جداسازی فوری مدیر از پروژه)
+//  - جست‌وجوی زنده‌ی فارسی (normalize: ی/ك عربی، نیم‌فاصله و فاصله‌ها)
+//  - پروژه‌های انتخاب‌شده از فهرست پنهان می‌شوند تا انتخاب تکراری رخ ندهد
+export function ProjectMultiSelect({
+  options,
+  values,
+  onChange,
+  placeholder = "انتخاب پروژه(ها)...",
+  disabled = false,
+}: {
+  options: ProjectOption[];
+  values: string[];
+  onChange: (ids: string[]) => void;
+  placeholder?: string;
+  disabled?: boolean;
+}) {
+  const [text, setText] = useState("");
+  const [open, setOpen] = useState(false);
+  const inputRef = useRef<HTMLInputElement | null>(null);
+  const ref = useClickOutside<HTMLDivElement>(() => {
+    setOpen(false);
+    setText("");
+  });
+
+  const byId = useMemo(() => new Map(options.map((o) => [o.id, o])), [options]);
+  const selected = values.map((id) => byId.get(id)).filter(Boolean) as ProjectOption[];
+  const q = normalize(text);
+  const available = useMemo(
+    () =>
+      options.filter((o) => !values.includes(o.id) && (!q || normalize(o.name).includes(q))),
+    [options, values, q],
+  );
+
+  const add = (id: string) => {
+    onChange([...values, id]);
+    setText("");
+    inputRef.current?.focus();
+  };
+  const remove = (id: string) => onChange(values.filter((v) => v !== id));
+
+  return (
+    <div ref={ref} className="relative min-w-52">
+      <div
+        className={cn(
+          "flex min-h-9 flex-wrap items-center gap-1 rounded-lg border border-line bg-panel px-2 py-1 text-[12px]",
+          disabled ? "opacity-60" : "cursor-text",
+        )}
+        onClick={() => {
+          if (!disabled) {
+            setOpen(true);
+            inputRef.current?.focus();
+          }
+        }}
+      >
+        {selected.map((p) => (
+          <span
+            key={p.id}
+            className="inline-flex max-w-full items-center gap-1 rounded-md bg-accent-bg px-2 py-0.5 font-semibold text-accent"
+          >
+            <span className="truncate">{p.name}</span>
+            {!disabled && (
+              <button
+                type="button"
+                aria-label={`جدا کردن ${p.name}`}
+                onClick={(e) => {
+                  e.stopPropagation();
+                  remove(p.id);
+                }}
+                className="cursor-pointer rounded p-0.5 hover:bg-accent/10"
+              >
+                <X className="h-3 w-3" />
+              </button>
+            )}
+          </span>
+        ))}
+        <input
+          ref={inputRef}
+          type="text"
+          dir="rtl"
+          disabled={disabled}
+          value={text}
+          onChange={(e) => {
+            setText(e.target.value);
+            setOpen(true);
+          }}
+          onFocus={() => setOpen(true)}
+          placeholder={selected.length ? "" : placeholder}
+          className="h-7 min-w-24 flex-1 border-0 bg-transparent px-1 text-[12px] outline-none placeholder:text-muted/70"
+        />
+      </div>
+      {open && !disabled && (
+        <div className="absolute z-40 mt-1 max-h-56 w-full min-w-52 overflow-auto rounded-xl border border-line bg-panel p-1 shadow-lg">
+          {available.length ? (
+            available.map((o) => (
+              <button
+                key={o.id}
+                type="button"
+                onClick={() => add(o.id)}
+                className="flex w-full cursor-pointer items-center rounded-lg px-2.5 py-1.5 text-start text-[12.5px] text-ink hover:bg-slate-bg"
+              >
+                {o.name}
+              </button>
+            ))
+          ) : (
+            <div className="px-2.5 py-2 text-[11.5px] text-muted">
+              {options.length === 0
+                ? "پروژه‌ای وجود ندارد"
+                : q
+                  ? "پروژه‌ای یافت نشد"
+                  : "همه‌ی پروژه‌ها متصل شده‌اند"}
+            </div>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/components/RequirePmProjects.tsx

@@ -0,0 +1,80 @@
+import { useEffect, useState, type ReactNode } from "react";
+import { apiV26 } from "../lib/api";
+import { useAuthStore } from "../store/auth";
+import { useLogout } from "../pages/Inventory/panelMenu";
+
+// گیتِ پروژه‌های مدیر پروژه (PM → 1:N):
+//  - لیست پروژه‌های تخصیص‌یافته را از بک‌اند می‌گیرد و پروژه‌ی فعالِ ذخیره‌شده را
+//    اعتبارسنجی می‌کند؛ اگر پروژه باطل شده باشد به اولین پروژه برمی‌گردد
+//    (localStorage هم با همان store به‌روز می‌شود).
+//  - اگر هیچ پروژه‌ای تخصیص نیافته باشد: صفحه‌ی خالی با پیام + دکمه‌ی خروج
+//    (بدون حلقه‌ی ریدایرکت و بدون باطل‌کردن نشست).
+//  - حالت توسعه (بدون توکن) از همین پروژه‌ی انتخابیِ dev استفاده می‌کند.
+export function RequirePmProjects({ children }: { children: ReactNode }) {
+  const user = useAuthStore((s) => s.user);
+  const isDev = useAuthStore((s) => s.isDev);
+  const setProjects = useAuthStore((s) => s.setProjects);
+  const logout = useLogout();
+
+  const isPm = user?.role === "pm";
+  const [state, setState] = useState<"loading" | "ok" | "empty">(isPm ? "loading" : "ok");
+
+  useEffect(() => {
+    if (!user || user.role !== "pm") {
+      setState("ok");
+      return;
+    }
+    if (isDev) {
+      setState(user.project_id ? "ok" : "empty");
+      return;
+    }
+    let alive = true;
+    setState("loading");
+    void apiV26.users
+      .myProjects()
+      .then((list) => {
+        if (!alive) return;
+        setProjects(list); // پروژه‌ی فعال را اعتبارسنجی/جایگزین می‌کند
+        setState(list.length ? "ok" : "empty");
+      })
+      .catch(() => {
+        // خطای شبکه نباید کاربر را قفل کند — با وضعیت فعلی ادامه می‌دهیم
+        if (alive) setState("ok");
+      });
+    return () => {
+      alive = false;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [user?.id, user?.role, isDev]);
+
+  if (state === "loading") {
+    return (
+      <div className="flex min-h-screen items-center justify-center text-sm text-muted">
+        در حال بارگذاری پروژه‌ها…
+      </div>
+    );
+  }
+
+  if (state === "empty") {
+    return (
+      <div className="flex min-h-screen items-center justify-center bg-bg px-4">
+        <div className="w-full max-w-md rounded-2xl border border-line bg-panel p-8 text-center shadow-sm">
+          <h1 className="text-[16px] font-extrabold">هیچ پروژه‌ای به شما تخصیص داده نشده است</h1>
+          <p className="mt-2 text-[12.5px] leading-6 text-muted">
+            در حال حاضر هیچ پروژه‌ای به شما تخصیص داده نشده است. برای دسترسی به پنل انبار، از مدیر
+            سیستم بخواهید پروژه‌ای را به شما اختصاص دهد.
+          </p>
+          <button
+            type="button"
+            onClick={logout}
+            className="mt-5 inline-flex h-10 w-full cursor-pointer items-center justify-center rounded-lg bg-accent px-4 text-[13px] font-bold text-white transition-colors hover:bg-accent-dark"
+          >
+            خروج از حساب
+          </button>
+        </div>
+      </div>
+    );
+  }
+
+  return <>{children}</>;
+}

frontend/src/components/StatsBar.tsx

@@ -8,31 +8,79 @@ export interface StatsBarProps {
   avgLeadTime: number | null; // روز
 }
 
-// نوار ۴ ستونه‌ی آمار
 export function StatsBar({ total, offered, accepted, avgLeadTime }: StatsBarProps) {
-  const stats: { label: string; value: string; color: string; icon: LucideIcon }[] = [
-    { label: "کل پیشنهادها", value: fmtNum(total), color: "text-ink", icon: ClipboardList },
-    // پیشنهاد باز = نارنجی، پذیرفته‌شده = آبی، رسیده = سبز
-    { label: "پیشنهاد باز", value: fmtNum(offered), color: "text-amber", icon: Inbox },
-    { label: "پذیرفته‌شده", value: fmtNum(accepted), color: "text-[#1d4ed8]", icon: CheckCircle2 },
-    { label: "میانگین lead time (روز)", value: avgLeadTime == null ? "—" : fmtNum(avgLeadTime), color: "text-green", icon: Timer },
+  const stats: {
+    label: string;
+    shortLabel: string;
+    value: string;
+    unit?: string;
+    color: string;
+    icon: LucideIcon;
+  }[] = [
+    {
+      label: "کل پیشنهادها",
+      shortLabel: "کل",
+      value: fmtNum(total),
+      color: "text-ink",
+      icon: ClipboardList,
+    },
+    {
+      label: "پیشنهاد باز",
+      shortLabel: "باز",
+      value: fmtNum(offered),
+      color: "text-amber",
+      icon: Inbox,
+    },
+    {
+      label: "پذیرفته‌شده",
+      shortLabel: "پذیرفته",
+      value: fmtNum(accepted),
+      color: "text-[#1d4ed8]",
+      icon: CheckCircle2,
+    },
+    {
+      label: "میانگین زمان تحویل",
+      shortLabel: "میانگین تحویل",
+      value: avgLeadTime == null ? "—" : fmtNum(avgLeadTime),
+      unit: avgLeadTime != null ? "روز" : undefined,
+      color: "text-green",
+      icon: Timer,
+    },
   ];
+
   return (
-    <section className="grid grid-cols-2 gap-3 sm:grid-cols-4">
+    <section className="grid grid-cols-4 gap-1.5 sm:gap-3">
       {stats.map((s) => (
         <div
           key={s.label}
-          className="rounded-lg border border-line bg-panel p-3.5 transition-colors hover:border-accent/40"
+          className="rounded-xl border border-line bg-panel p-2 text-center transition-colors hover:border-accent/40 sm:rounded-lg sm:p-3.5 sm:text-right"
         >
-          <div className="flex items-center justify-between">
-            <div className="text-[11px] font-medium text-muted">{s.label}</div>
-            <span className="flex h-6 w-6 items-center justify-center rounded-md bg-slate-bg text-muted">
+          {/* عنوان کارت */}
+          <div className="flex items-center justify-center sm:justify-between">
+            <span className="truncate text-[10px] font-medium text-muted sm:text-[11px]">
+              <span className="sm:hidden">{s.shortLabel}</span>
+              <span className="hidden sm:inline">{s.label}</span>
+            </span>
+
+            {/* آیکون در دسکتاپ */}
+            <span className="hidden h-6 w-6 shrink-0 items-center justify-center rounded-md bg-slate-bg text-muted sm:flex">
               <s.icon className="h-3.5 w-3.5" strokeWidth={2} />
             </span>
           </div>
-          <div className={`mt-1 text-[22px] font-extrabold leading-8 tabular-nums ${s.color}`}>{s.value}</div>
+
+          {/* مقدار عددی به همراه واحد روز */}
+          <div
+            className={`mt-0.5 flex items-baseline justify-center sm:justify-start gap-1 text-base font-extrabold leading-5 tabular-nums sm:mt-1 sm:text-[22px] sm:leading-8 ${s.color}`}
+          >
+            <span>{s.value}</span>
+            {s.unit && (
+              <span className="text-[10px] font-medium text-muted sm:text-xs">
+                {s.unit}
+              </span>
+            )}
+          </div>
         </div>
       ))}
     </section>
   );
-}
+}

frontend/src/components/TermsheetCard.tsx

@@ -8,19 +8,17 @@ export interface TermsheetItem {
 }
 
 export interface TermsheetCardProps {
-  index: number; // 1-based → «گزینه N»
+  index: number;
   milestones: Milestone[];
   onMilestonesChange: (ms: Milestone[]) => void;
-  // اقلام قابل تیک (مرحله ۲)
   items?: TermsheetItem[];
-  coveredIds?: string[]; // tempIdهایی که تیک دارند
+  coveredIds?: string[];
   onCoverageChange?: (ids: string[]) => void;
   onRemove?: () => void;
-  defaultAll?: boolean; // وقتی هیچ تیکی نیست، پیش‌فرض همه تیک بخورند
+  defaultAll?: boolean;
   removable?: boolean;
 }
 
-// کارت ترم‌شیت — هم در ویزارد (مرحله ۳) هم در مودال پذیرش/ویرایش
 export function TermsheetCard({
   index,
   milestones,
@@ -33,7 +31,6 @@ export function TermsheetCard({
   removable = true,
 }: TermsheetCardProps) {
   const covered = new Set(coveredIds);
-  // پیش‌فرض: وقتی هیچ قلمی تیک نخورده و defaultAll فعال است → همه تیک
   const effectiveCovered = covered.size === 0 && defaultAll ? items.map((i) => i.tempId) : coveredIds;
 
   const toggle = (tempId: string, checked: boolean) => {
@@ -49,17 +46,25 @@ export function TermsheetCard({
   };
 
   return (
-    <div className="variant-card">
-      <div className="variant-head">
-        <span className="variant-num">گزینه {faNum(index)}</span>
+    <div className="rounded-xl border border-line bg-panel p-4">
+      <div className="flex items-center justify-between mb-2">
+        <span className="font-bold text-[13px]">گزینه {faNum(index)}</span>
         {removable && onRemove && (
-          <button type="button" className="variant-x" title="حذف" onClick={onRemove}>
-            ×
+          <button
+            type="button"
+            className="text-gray-400 hover:text-red-500 p-1 rounded transition"
+            title="حذف گزینه"
+            onClick={onRemove}
+          >
+            <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+              <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={1.8} d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+            </svg>
           </button>
         )}
       </div>
+
       <div className="mb-1.5 text-[12px] text-muted">مراحل پرداخت:</div>
-      <div className="mb-1 flex flex-col gap-1.5">
+      <div className="mb-2 flex flex-col gap-1.5">
         {milestones.map((m, i) => (
           <MilestoneRow
             key={i}
@@ -69,33 +74,33 @@ export function TermsheetCard({
           />
         ))}
       </div>
-      <button type="button" className="btn-line-file mt-1" onClick={addMilestone}>
-        ＋ مرحله پرداخت
+
+      <button
+        type="button"
+        className="w-full py-1.5 border border-dashed border-gray-300 hover:border-blue-500 hover:text-blue-600 rounded-lg text-[12px] text-gray-500 transition mb-3"
+        onClick={addMilestone}
+      >
+        + مرحله پرداخت
       </button>
 
       {items.length > 0 && (
-        <div className="ts-items-box">
-          <div className="ts-items-title">این termsheet کدام اقلام (مرحله ۲) را پوشش می‌دهد؟</div>
-          {items.length === 0 ? (
-            <div className="ts-items-empty">هنوز قلمی در مرحله‌ی ۲ اضافه نشده.</div>
-          ) : (
-            <div>
-              {items.map((it) => (
-                <label key={it.tempId} className="ts-item-label">
-                  <input
-                    type="checkbox"
-                    className="ts-item-cb"
-                    data-item-temp-id={it.tempId}
-                    checked={effectiveCovered.includes(it.tempId)}
-                    onChange={(e) => toggle(it.tempId, e.target.checked)}
-                  />
-                  {it.label}
-                </label>
-              ))}
-            </div>
-          )}
+        <div className="pt-2 border-t border-line/60">
+          <div className="text-[12px] text-muted mb-1.5">این termsheet کدام اقلام (مرحله ۲) را پوشش می‌دهد؟</div>
+          <div className="flex flex-col gap-1 text-[12px]">
+            {items.map((it) => (
+              <label key={it.tempId} className="flex items-center gap-2 cursor-pointer text-gray-700">
+                <input
+                  type="checkbox"
+                  className="rounded border-gray-300"
+                  checked={effectiveCovered.includes(it.tempId)}
+                  onChange={(e) => toggle(it.tempId, e.target.checked)}
+                />
+                <span>{it.label}</span>
+              </label>
+            ))}
+          </div>
         </div>
       )}
     </div>
   );
-}
+}

frontend/src/components/TopicGrid.tsx

@@ -5,36 +5,65 @@ import { faNum } from "../lib/formatters";
 import { cn } from "../lib/utils";
 
 export interface TopicGridProps {
-  topics: Topic[]; // از store (API) می‌آید
+  topics: Topic[];
   selectedTopic?: string;
   onSelect: (topicName: string) => void;
-  showCounts?: boolean; // تعداد تأمین‌کننده‌های هر تاپیک
-  counts?: Record<string, number>; // topic name → count
+  showCounts?: boolean;
+  counts?: Record<string, number>;
 }
 
-// گرید تاپیک‌ها (از /material-categories — نه لیست ثابت)
 export function TopicGrid({ topics, selectedTopic, onSelect, showCounts = false, counts }: TopicGridProps) {
   if (!topics.length) {
     return <EmptyState emoji="🗂️" text="در حال بارگذاری دسته‌بندی‌ها…" />;
   }
+
   return (
-    <div className="grid grid-cols-2 gap-3 sm:grid-cols-3 lg:grid-cols-4">
+    <div className="grid grid-cols-2 gap-3 sm:gap-4 sm:grid-cols-3 lg:grid-cols-4">
       {topics.map((t) => {
         const selected = selectedTopic != null && normalize(selectedTopic) === normalize(t.name);
         const count = counts?.[t.name] ?? 0;
+
         return (
           <button
             type="button"
             key={t.key}
-            className={cn("topic-card", selected && "selected")}
             onClick={() => onSelect(t.name)}
+            className={cn(
+              "group relative flex flex-col items-center justify-between rounded-2xl border bg-white p-2.5 sm:p-4 text-center transition-all duration-200 cursor-pointer shadow-xs active:scale-[0.98] overflow-hidden",
+              selected
+                ? "border-blue-600 ring-2 ring-blue-600/25 shadow-md bg-blue-50/20"
+                : "border-slate-200 hover:border-blue-300 hover:shadow-md"
+            )}
           >
-            <img src={t.icon} alt="" />
-            <div className="t-name">{t.name}</div>
-            {showCounts && <div className="t-count">{faNum(count)} تأمین‌کننده</div>}
+            {/* کادر تصویر بسیار بزرگ‌تر شده برای پر کردن تمام فضای مربع */}
+            <div className="flex h-36 sm:h-48 md:h-52 w-full items-center justify-center overflow-hidden rounded-xl bg-slate-50/50">
+              <img
+                src={t.icon}
+                alt={t.name}
+                className="h-full w-full object-contain transform scale-115 group-hover:scale-125 transition-transform duration-300 drop-shadow-xs"
+                loading="lazy"
+              />
+            </div>
+
+            {/* بخش عنوان و تعداد */}
+            <div className="mt-3 w-full pb-1">
+              <div
+                className={cn(
+                  "truncate text-[13px] sm:text-[15px] font-bold transition-colors",
+                  selected ? "text-blue-600" : "text-slate-800 group-hover:text-blue-600"
+                )}
+              >
+                {t.name}
+              </div>
+              {showCounts && (
+                <div className="mt-0.5 truncate text-[11px] sm:text-xs text-slate-400 font-medium">
+                  {faNum(count)} تأمین‌کننده
+                </div>
+              )}
+            </div>
           </button>
         );
       })}
     </div>
   );
-}
+}

frontend/src/components/layout/Header.tsx

@@ -38,7 +38,7 @@ export function Header({ title, sub, backTo, backLabel = "بازگشت", actions
         <button
           type="button"
           onClick={goBack}
-          className="inline-flex cursor-pointer items-center gap-0.5 rounded-md px-2 py-1 text-[13px] text-muted transition-colors hover:bg-slate-bg hover:text-ink max-md:px-2.5 max-md:py-2"
+          className="hidden md:inline-flex cursor-pointer items-center gap-0.5 rounded-md px-2 py-1 text-[13px] text-muted transition-colors hover:bg-slate-bg hover:text-ink"
         >
           <ChevronRight className="h-4 w-4" />
           {backLabel}
@@ -66,4 +66,4 @@ export function PageLayout({
   return (
     <div className={cn("mx-auto w-full max-w-[1200px] px-4 py-4 max-md:pb-24", className)}>{children}</div>
   );
-}
+}

frontend/src/components/layout/MobileTabBar.tsx

@@ -48,7 +48,7 @@ const ADMIN_INV_TABS: TabDef[] = [
 function TabBar({ tabs }: { tabs: TabDef[] }) {
   return (
     <nav
-      className="fixed inset-x-0 bottom-0 z-40 border-t border-line bg-panel md:hidden"
+      className="fixed inset-x-0 bottom-0 z-40 border-t border-line bg-panel/95 backdrop-blur-md md:hidden"
       style={{ paddingBottom: "env(safe-area-inset-bottom)" }}
     >
       <div className="grid grid-cols-4">
@@ -59,13 +59,13 @@ function TabBar({ tabs }: { tabs: TabDef[] }) {
             end={t.end}
             className={({ isActive }) =>
               cn(
-                "flex min-h-[56px] flex-col items-center justify-center gap-0.5 whitespace-nowrap px-1 text-[10.5px] font-medium transition-colors",
-                isActive ? "text-accent" : "text-muted",
+                "flex min-h-[66px] flex-col items-center justify-center gap-1.5 whitespace-nowrap px-1 py-1 transition-all active:scale-95",
+                isActive ? "text-accent font-bold" : "text-muted hover:text-ink font-medium",
               )
             }
           >
-            <t.icon className="h-5 w-5" strokeWidth={1.8} />
-            <span>{t.label}</span>
+            <t.icon className="h-6.5 w-6.5" strokeWidth={2.2} />
+            <span className="text-[12px] leading-tight tracking-tight">{t.label}</span>
           </NavLink>
         ))}
       </div>
@@ -97,4 +97,4 @@ export function MobileTabBar() {
     pathname.startsWith("/suppliers");
   if (onOfficePage && isOffice) return <TabBar tabs={PROC_TABS} />;
   return null;
-}
+}

frontend/src/components/ui/button.tsx

@@ -4,17 +4,17 @@ import { cva, type VariantProps } from "class-variance-authority";
 import { cn } from "../../lib/utils";
 
 const buttonVariants = cva(
-  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-lg text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-all duration-200 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:pointer-events-none disabled:opacity-50 active:scale-[0.98] [&_svg]:pointer-events-none [&_svg]:shrink-0",
   {
     variants: {
       variant: {
         default: "bg-accent text-white shadow-sm hover:bg-accent-dark",
         primary: "bg-accent text-white shadow-sm hover:bg-accent-dark",
-        slate: "bg-slate-bg text-ink hover:bg-line",
-        line: "border border-line bg-panel text-ink hover:bg-slate-bg",
+        slate: "bg-slate-bg text-ink border border-transparent hover:brightness-95",
+        line: "border border-line bg-panel text-ink shadow-sm hover:bg-slate-bg",
         ghost: "hover:bg-slate-bg text-ink",
-        green: "bg-green text-white hover:brightness-95",
-        danger: "bg-red-bg text-red hover:bg-red hover:text-white",
+        green: "bg-green text-white shadow-sm hover:brightness-95",
+        danger: "bg-red-bg text-red shadow-sm hover:bg-red hover:text-white",
       },
       size: {
         default: "h-9 px-4 py-2",
@@ -44,4 +44,4 @@ const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
 );
 Button.displayName = "Button";
 
-export { Button, buttonVariants };
+export { Button, buttonVariants };

frontend/src/hooks/useMaterials.ts

@@ -17,7 +17,7 @@ export function useAddMaterial() {
   const invalidate = useInvalidateStore();
   return useMutation({
     mutationFn: (m: Material) => api.materials.create(m),
-    onMutate: (m) => addMaterial(m),
+    onSuccess: (created) => addMaterial(created),
     onSettled: () => invalidate(),
   });
 }

frontend/src/lib/analytics.ts

@@ -0,0 +1,80 @@
+// ============================================================
+// Product analytics + error capture (Phase 2)
+//
+// - OpenPanel (@openpanel/web): funnels/usage — initialized only when
+//   VITE_OPENPANEL_URL and VITE_OPENPANEL_CLIENT_ID are set (build args),
+//   so local dev and air-gapped environments stay silent.
+// - GlitchTip (@sentry/react): frontend exception capture, only when
+//   VITE_SENTRY_DSN is set.
+//
+// Both are no-ops without configuration; every helper is safe to call
+// unconditionally from anywhere in the app.
+// ============================================================
+import * as Sentry from "@sentry/react";
+
+type Props = Record<string, unknown>;
+
+declare global {
+  interface Window {
+    op?: (...args: unknown[]) => void;
+  }
+}
+
+const OPENPANEL_URL = (import.meta.env?.VITE_OPENPANEL_URL as string | undefined)?.trim();
+const OPENPANEL_CLIENT_ID = (import.meta.env?.VITE_OPENPANEL_CLIENT_ID as string | undefined)?.trim();
+const SENTRY_DSN = (import.meta.env?.VITE_SENTRY_DSN as string | undefined)?.trim();
+
+export function initAnalytics(): void {
+  if (SENTRY_DSN) {
+    Sentry.init({
+      dsn: SENTRY_DSN,
+      environment: (import.meta.env?.MODE as string | undefined) ?? "production",
+      // Frontend traces are expensive and rarely needed — errors only.
+      tracesSampleRate: 0,
+    });
+  }
+  if (OPENPANEL_URL && OPENPANEL_CLIENT_ID) {
+    try {
+      window.op?.("init", {
+        apiUrl: OPENPANEL_URL,
+        clientId: OPENPANEL_CLIENT_ID,
+        trackScreenViews: true, // pageview → which pages users visit
+      });
+    } catch {
+      /* analytics must never break the app */
+    }
+  }
+}
+
+/** Attach the ERP user identity to analytics (after login / app load). */
+export function identifyUser(profile: {
+  id?: string;
+  name?: string;
+  role?: string | null;
+}): void {
+  if (!profile.id) return;
+  try {
+    window.op?.("identify", {
+      profileId: profile.id,
+      firstName: profile.name || undefined,
+      data: { role: profile.role ?? undefined },
+    });
+    track("user_identified", { role: profile.role ?? undefined });
+  } catch {
+    /* ignore */
+  }
+}
+
+export function track(event: string, properties?: Props): void {
+  try {
+    window.op?.("track", event, properties ?? {});
+  } catch {
+    /* ignore */
+  }
+}
+
+export function captureError(err: unknown): void {
+  if (SENTRY_DSN) Sentry.captureException(err);
+}
+
+export const analyticsEnabled = Boolean(OPENPANEL_URL && OPENPANEL_CLIENT_ID);

frontend/src/lib/api.ts

@@ -14,6 +14,7 @@
 
 import { normalize } from "./normalize";
 import { buildTopics } from "./topics";
+import { jalaliToGregorian, toAsciiDigits } from "./jalali";
 import { useAuthStore } from "../store/auth";
 import type {
   Attachment,
@@ -33,7 +34,7 @@ import type {
   Warehouse,
 } from "./types";
 
-const BASE_URL = (import.meta.env.VITE_API_BASE_URL as string | undefined)?.trim() || "/api/v1";
+const BASE_URL = (import.meta.env?.VITE_API_BASE_URL as string | undefined)?.trim() || "/api/v1";
 const PAGE_SIZE = 100;
 
 // حذف کلیدهای خالی/undefined از پارامترهای کوئری — URLSearchParams مقدار
@@ -69,6 +70,19 @@ function authHeaders(init?: RequestInit): Record<string, string> {
   return headers;
 }
 
+// پروژه‌ی فعالِ مدیر پروژه (چند-پروژه‌ای، 1:N): برای همه‌ی مسیرهای پنل انبار
+// صریحاً ارسال می‌شود تا بک‌اند داده‌های همان پروژه را برگرداند/اعتبارسنجی کند.
+// ادمین/مدیر تدارکات بدون پارامتر (همه‌ی پروژه‌ها) باقی می‌ماند.
+function activeProjectId(): string | null {
+  const { user } = useAuthStore.getState();
+  return user?.role === "pm" ? user.project_id : null;
+}
+
+function projectQuery(projectId?: string | null): string {
+  const pid = projectId ?? activeProjectId();
+  return pid ? `?project_id=${pid}` : "";
+}
+
 // ترجمه‌ی پیام‌های رایج اعتبارسنجی FastAPI (422) به فارسی
 const VALIDATION_FA = (msg: string): string => {
   const lower = msg.toLowerCase();
@@ -122,22 +136,42 @@ const FIELD_FA: Record<string, string> = {
   expiry_date: "تاریخ انقضا",
   accepted_date: "تاریخ پذیرش",
   arrived_date: "تاریخ رسید",
+  due_date: "تاریخ سررسید",
+  schedule_steps: "مراحل پرداخت",
+  milestones: "مراحل پرداخت",
+  amount: "مبلغ",
+  step_no: "شماره مرحله",
 };
 
-const faField = (field: string): string => {
-  const last = field.split(".").filter(Boolean).pop() || field;
+export const faField = (field: string): string => {
+  const parts = field.split(".").filter((p) => p && !/^\d+$/.test(p));
+  const last = parts.pop() || field;
   return FIELD_FA[last] || FIELD_FA[field] || field;
 };
 
-// ترجمه‌ی خطای HTTP بر اساس کد وضعیت
-const faHttpError = (status: number, fallback: string): string => {
+// ترجمه‌ی خطای HTTP بر اساس کد وضعیت — پیام‌های معنادار بک‌اند حفظ می‌شوند
+export const faHttpError = (status: number, fallback: string): string => {
   if (status === 413) return "فایل انتخاب‌شده از حد مجاز (۵ مگابایت) بزرگ‌تر است";
-  if (status === 404) return "مورد درخواستی یافت نشد";
-  if (status === 409) return "تعارض داده — رکورد تکراری یا وضعیت نامعتبر";
-  if (status === 400) return "داده‌ی ارسال‌شده نامعتبر است";
+  if (status === 404 && (!fallback || fallback.startsWith("خطای سرور"))) return "مورد درخواستی یافت نشد";
+  if (status === 409 && (!fallback || fallback.startsWith("خطای سرور"))) return "تعارض داده — رکورد تکراری یا وضعیت نامعتبر";
+  if (status === 400 && (!fallback || fallback.startsWith("خطای سرور"))) return "داده‌ی ارسال‌شده نامعتبر است";
   return fallback;
 };
 
+export class ApiError extends Error {
+  status: number;
+  code?: string;
+  field?: string;
+
+  constructor(message: string, status: number, code?: string, field?: string) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.field = field;
+  }
+}
+
 // ============================================================
 // HTTP helpers — envelope بک‌اند: {"data": ..., "meta": ...}
 // ============================================================
@@ -150,27 +184,43 @@ async function request<T>(path: string, init?: RequestInit): Promise<T> {
       headers: authHeaders(init),
     });
   } catch {
-    throw new Error("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟");
+    throw new ApiError("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟", 0);
   }
   if (!res.ok) {
     let msg = `خطای سرور (${res.status})`;
+    let errCode: string | undefined;
+    let errField: string | undefined;
+
     try {
       const body = await res.json();
-      if (body?.error?.message) {
-        msg = body.error.message;
+      if (body?.error) {
+        errCode = body.error.code;
+        errField = body.error.field;
+        const rawMsg = body.error.message || "";
+        const fName = errField ? faField(errField) : "";
+        if (fName && rawMsg) {
+          msg = `داده‌ی «${fName}» نامعتبر است: ${rawMsg}`;
+        } else if (rawMsg) {
+          msg = rawMsg;
+        }
       } else if (Array.isArray(body?.detail)) {
         // FastAPI 422 — آرایه‌ی خطاهای اعتبارسنجی با پیام انگلیسی
         const first = body.detail[0];
-        const field = first?.loc?.length ? String(first.loc[first.loc.length - 1]) : "";
+        const loc = first?.loc || [];
+        const filteredLoc = loc.filter((p: unknown) => p !== "body" && p !== "query" && p !== "path");
+        errField = filteredLoc.join(".");
+        const fieldName = filteredLoc.length ? String(filteredLoc[filteredLoc.length - 1]) : "";
         const fa = first?.msg ? VALIDATION_FA(String(first.msg)) : "داده‌ی ارسال‌شده نامعتبر است";
-        msg = field ? `داده‌ی «${faField(field)}» نامعتبر است: ${fa}` : fa;
+        const fName = fieldName ? faField(fieldName) : "";
+        msg = fName ? `داده‌ی «${fName}» نامعتبر است: ${fa}` : fa;
       } else if (body?.detail) {
         msg = String(body.detail);
       }
     } catch {
       /* بدنۀ خطا JSON نیست */
     }
-    throw new Error(faHttpError(res.status, msg));
+    const finalMsg = faHttpError(res.status, msg);
+    throw new ApiError(finalMsg, res.status, errCode, errField);
   }
   return (await res.json()) as T;
 }
@@ -272,6 +322,8 @@ interface RawDecision {
   id: string;
   status: string;
   chosen_item_termsheet_id?: string | null;
+  project_id?: string | null;
+  project?: RawProject | null;
   adjusted_unit_price?: number | null;
   decided_at?: string | null;
 }
@@ -296,6 +348,7 @@ interface RawLineItem {
   termsheet_ids?: string[] | null;
   accepted_termsheet_id?: string | null; // id ترم‌شیت پذیرفته‌شده (task: خط آبی)
   projects?: RawProject[] | null; // پروژه‌های تخصیص‌یافته به این قلم
+  target_project?: RawProject | null;
 }
 interface RawTermsheet {
   id: string;
@@ -504,6 +557,7 @@ function adaptMaterial(raw: RawMaterial, lookup: Lookup): Material {
 }
 
 function adaptLineItem(raw: RawLineItem): Quote["line_items"][number] {
+  const targetProj = raw.target_project || raw.decision?.project || null;
   return {
     id: raw.id,
     material_id: raw.material?.id || "",
@@ -524,6 +578,8 @@ function adaptLineItem(raw: RawLineItem): Quote["line_items"][number] {
       quantity: a.quantity,
     })),
     projects: (raw.projects || []).map((p) => ({ id: p.id, name: p.name })),
+    target_project: targetProj ? { id: targetProj.id, name: targetProj.name } : null,
+    target_project_id: raw.decision?.project_id || targetProj?.id || null,
   };
 }
 
@@ -649,23 +705,66 @@ function adaptAttachment(raw: RawAttachment): Attachment {
 
 function toDateOnly(v: string | null | undefined): string | null {
   if (!v) return null;
-  const m = String(v).match(/^(\d{4}-\d{2}-\d{2})/);
-  if (m) return m[1];
-  // datetime کامل → تاریخ به وقت محلی (نه UTC که یک روز عقب می‌افتد)
-  const d = new Date(v);
+  const str = toAsciiDigits(v).trim();
+  if (!str) return null;
+
+  // ۱. فرمت جلالی با اسلش، خط تیره یا نقطه (سال‌های ۱۳۰۰ تا ۱۵۰۰)
+  const jm = str.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})/);
+  if (jm) {
+    const jy = parseInt(jm[1], 10);
+    const jmon = parseInt(jm[2], 10);
+    const jd = parseInt(jm[3], 10);
+    const [gy, gm, gd] = jalaliToGregorian(jy, jmon, jd);
+    return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+  }
+
+  // ۲. فرمت میلادی استاندارد YYYY-MM-DD
+  const gm = str.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  if (gm && parseInt(gm[1], 10) >= 1900) return str;
+
+  // ۳. رشته‌ی datetime کامل یا مقادیر دیگر
+  const d = new Date(str);
   if (Number.isNaN(d.getTime())) return null;
+  if (d.getFullYear() < 1900 && d.getFullYear() >= 1300) {
+    const [gy, gm, gd] = jalaliToGregorian(d.getFullYear(), d.getMonth() + 1, d.getDate());
+    return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+  }
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
 }
+
 function toDateTime(v: string | null | undefined): string | null {
-  const d = toDateOnly(v);
-  if (!d) return null;
-  return /^\d{4}-\d{2}-\d{2}$/.test(v as string) ? d + "T00:00:00Z" : (v as string);
+  if (!v) return null;
+  const str = toAsciiDigits(v).trim();
+  if (!str) return null;
+
+  // ۱. تاریخ جلالی با زمان اختیاری
+  const jm = str.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
+  if (jm) {
+    const jy = parseInt(jm[1], 10);
+    const jmon = parseInt(jm[2], 10);
+    const jd = parseInt(jm[3], 10);
+    const h = jm[4] != null ? parseInt(jm[4], 10) : 0;
+    const m = jm[5] != null ? parseInt(jm[5], 10) : 0;
+    const s = jm[6] != null ? parseInt(jm[6], 10) : 0;
+    const [gy, gm, gd] = jalaliToGregorian(jy, jmon, jd);
+    return new Date(gy, gm - 1, gd, h, m, s).toISOString();
+  }
+
+  // ۲. اگر میلادی استاندارد ISO است
+  const d = new Date(str);
+  if (!Number.isNaN(d.getTime()) && d.getFullYear() >= 1900) {
+    return /^\d{4}-\d{2}-\d{2}$/.test(str) ? str + "T00:00:00Z" : str;
+  }
+
+  const dateOnly = toDateOnly(str);
+  return dateOnly ? dateOnly + "T00:00:00Z" : null;
 }
 function todayIso(): string {
   return new Date().toISOString().slice(0, 10);
 }
-function looksLikeUuid(v: string): boolean {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
+export function looksLikeUuid(v: string | null | undefined): boolean {
+  if (!v) return false;
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(String(v).trim());
 }
 
 // ============================================================
@@ -758,6 +857,13 @@ export const api = {
       // مقدار پیش‌فرض/واحد جادویی؛ واحد خالی یعنی خطای صریح «واحد مشخص نشده»)
       // پروژه‌های هر قلم هم به id واقعی ترجمه می‌شوند (در صورت نبودن ساخته می‌شوند)
       for (let i = 0; i < lineItems.length; i++) {
+        let matId = realMaterialId(lineItems[i].material_id);
+        if (!looksLikeUuid(matId)) {
+          const rawMats = await getData<RawMaterial[]>(`/materials?page_size=100`);
+          const found = rawMats.find((rm) => rm.id === matId) || rawMats[0];
+          if (found) matId = found.id;
+        }
+        lineItems[i].material_id = matId;
         lineItems[i].unit_id = await unitIdByNameOrCreate(lookup, q.line_items[i].unit);
         for (const p of q.line_items[i].projects || []) {
           const pid = looksLikeUuid(p.id) ? p.id : await projectIdByNameOrCreate(p.name);
@@ -842,23 +948,16 @@ export const api = {
 
       if (becomingAccepted) {
         const acceptedTs = (patch.termsheets || []).filter((t) => t.status === "accepted");
-        // تخصیص پروژه به هر قلم — نام‌ها به id واقعی ترجمه می‌شوند
-        const itemProjects: { line_item_id: string; project_ids: string[] }[] = [];
-        const allProjectIds: string[] = [];
-        const seenPids = new Set<string>();
+        // پروژه‌ی واحدِ انتخاب‌شده برای هر قلم (item_decisions.project_id)
+        const targetProjByLine = new Map<string, string>();
         for (const li of patch.line_items || []) {
-          const ids: string[] = [];
-          for (const p of li.projects || []) {
-            const pid = looksLikeUuid(p.id) ? p.id : await projectIdByNameOrCreate(p.name);
-            if (!pid) continue;
-            ids.push(pid);
-            if (!seenPids.has(pid)) {
-              seenPids.add(pid);
-              allProjectIds.push(pid);
-            }
+          const tp = li.target_project;
+          if (tp && tp.name) {
+            const pid = looksLikeUuid(tp.id) ? tp.id : await projectIdByNameOrCreate(tp.name);
+            if (pid) targetProjByLine.set(li.id, pid);
           }
-          itemProjects.push({ line_item_id: li.id, project_ids: ids });
         }
+
         const payload = {
           accepted_termsheets: acceptedTs.map((t) => ({
             id: looksLikeUuid(t.id) ? t.id : undefined,
@@ -874,11 +973,7 @@ export const api = {
           item_decisions: (patch.line_items || []).map((li) => {
             const idx = li.accepted_ts_id ? acceptedTs.findIndex((t) => t.id === li.accepted_ts_id) : -1;
             const chosen = !li.rejected && idx >= 0;
-            // پروژه‌ی واحدِ انتخاب‌شده برای این قلم — مستقیم داخل decision می‌رود تا
-            // «کالاهای در راه» همان مدیر پروژه را (با item_decisions.project_id)
-            // نشان دهد؛ قبلاً فقط item_projects جداگانه می‌رفت و decision بدون
-            // پروژه می‌ماند (قلم‌ها در پنل هیچ مدیر پروژه‌ای دیده نمی‌شدند)
-            const chosenProjId = itemProjects.find((p) => p.line_item_id === li.id)?.project_ids[0];
+            const chosenProjId = targetProjByLine.get(li.id);
             return {
               line_item_id: li.id,
               status: chosen ? "chosen" : "rejected",
@@ -887,14 +982,10 @@ export const api = {
               ...(li.unit_price != null ? { adjusted_unit_price: li.unit_price } : {}),
             };
           }),
-          item_projects: itemProjects,
+          item_projects: [], // کاندیداهای قبلی در line_item_projects کاملاً حفظ می‌شوند
         };
         await patchData(`/quotes/${id}/accept`, payload);
-        // پروژه‌های سطح پیشنهاد با اتحاد پروژه‌های اقلام همگام می‌شوند
-        if (allProjectIds.length) {
-          await patchData(`/quotes/${id}`, { project_ids: allProjectIds });
-        }
-        return { ...current, ...patch } as Quote;
+        return { ...current, ...patch, projects: current.projects } as Quote;
       }
 
       // --- ویرایش ساده: اقلام/termsheetها (جایگزینی کامل) + فیلدهای metadata ---
@@ -1032,8 +1123,10 @@ export const api = {
       const unitId = await unitIdByNameOrCreate(lookup, unitName);
       // برند — اگر تعریف نشده، در جدول brands ساخته و به متریال متصل می‌شود
       const brandId = await brandIdByNameOrCreate(lookup, m.brand);
-      // تایپ جلوی برنامه name ندارد — از متریال/برند/مشخصه ساخته می‌شود
-      const name = [m.brand, m.category, ...(m.specs || [])].filter(Boolean).join(" ") || "کالای جدید";
+      // name فقط نامِ خودِ متریال است؛ برند در brand_ids و مشخصه‌ها در
+      // attributes (EAV) ذخیره می‌شوند. اگر برند/مشخصه داخل name ریخته شود،
+      // در ویزارد به‌عنوان «نامِ متریال» کش می‌شود و مشخصه‌ها در نام ظاهر می‌شوند.
+      const name = (m.category || m.brand || (m.specs || []).join(" ") || "").trim() || "کالای جدید";
       // مشخصه‌ها به‌صورت attribute (EAV) ذخیره می‌شوند تا بعد از رفرش دیده شوند
       const attrs: { attribute_definition_id: string; value: string }[] = [];
       const seen = new Set<string>();
@@ -1189,8 +1282,31 @@ export const api = {
     remove: async (quoteId: string, kind: FileKind, id: string): Promise<void> => {
       await deleteData(`/quotes/${quoteId}/${kind}/${id}`);
     },
-    downloadUrl: (quoteId: string, kind: FileKind, id: string): string =>
-      `${BASE_URL}/quotes/${quoteId}/${kind}/${id}`,
+    // دانلود احراز هویت‌شده: <a href> توکن Authorization نمی‌فرستد، پس بایت‌ها
+    // را با توکن می‌گیریم و به شکل blob در مرورگر ذخیره می‌کنیم.
+    download: async (quoteId: string, kind: FileKind, id: string, fileName: string): Promise<void> => {
+      let res: Response;
+      try {
+        res = await fetch(`${BASE_URL}/quotes/${quoteId}/${kind}/${id}`, {
+          headers: authHeaders(),
+        });
+      } catch {
+        throw new ApiError("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟", 0);
+      }
+      if (!res.ok) throw new ApiError(faHttpError(res.status, "خطای سرور"), res.status);
+      const blob = await res.blob();
+      const url = URL.createObjectURL(blob);
+      try {
+        const a = document.createElement("a");
+        a.href = url;
+        a.download = fileName || "attachment";
+        document.body.appendChild(a);
+        a.click();
+        a.remove();
+      } finally {
+        URL.revokeObjectURL(url);
+      }
+    },
   },
 
   // ---------- برندها (از بک‌اند) ----------
@@ -1207,6 +1323,17 @@ export const api = {
   brandsList: async (): Promise<{ id: string; name: string }[]> => {
     return getData<{ id: string; name: string }[]>(`/brands?page_size=${PAGE_SIZE}`);
   },
+  // مشخصه‌ها — رجیستری سراسری (attribute-definitions)، مستقل از تاپیک/دسته/برند.
+  // ویزارد از این لیست به‌عنوان منبع سراسری مشخصه‌ها استفاده می‌کند تا مشخصه‌های
+  // ثبت‌شده در پیشنهادهای قبلی همیشه در دسترس باشند.
+  specsList: async (): Promise<string[]> => {
+    const raw = await getData<{ label?: string; attribute_key?: string }[]>(
+      `/attribute-definitions?page_size=${PAGE_SIZE}`,
+    );
+    return raw
+      .map((d) => (d.label || "").trim() || (d.attribute_key || "").replace(/^spec_/, "").trim())
+      .filter(Boolean);
+  },
 
   // ---------- واحدها (از بک‌اند) ----------
   unitsList: async (): Promise<RawUnit[]> => {
@@ -1237,6 +1364,10 @@ async function fetchProjects(): Promise<RawProject[]> {
 async function projectIdByNameOrCreate(name: string | null | undefined): Promise<string | null> {
   if (!name) return null;
   const projects = await fetchProjects();
+  if (looksLikeUuid(name)) {
+    const byId = projects.find((x) => x.id.toLowerCase() === name.toLowerCase());
+    if (byId) return byId.id;
+  }
   const pid = projectIdByName(projects, name);
   if (pid) return pid;
   const raw = await postData<RawProject>("/projects", { name });
@@ -1368,8 +1499,12 @@ async function specDefinitionId(spec: string): Promise<string | null> {
 
 // utility برای ساخت id موقت جدید (ویزارد — قبل از ذخیره در بک‌اند)
 export function nextId(prefix: string, items: { id: string }[]): string {
+  const regex = new RegExp(`^${prefix}(\\d+)$`);
   const max = items
-    .map((x) => parseInt(String(x.id).replace(/\D/g, ""), 10))
+    .map((x) => {
+      const m = String(x.id).match(regex);
+      return m ? parseInt(m[1], 10) : 0;
+    })
     .filter((n) => !Number.isNaN(n))
     .reduce((a, b) => Math.max(a, b), 0);
   return prefix + (max + 1);
@@ -1450,6 +1585,8 @@ export interface UserRow {
   role_label: string | null;
   project_id: string | null;
   project_name: string | null;
+  // 1:N — every project this PM manages (oldest first).
+  projects?: { id: string; name: string }[];
   created_at: string;
 }
 
@@ -1460,7 +1597,6 @@ export const apiV26 = {
     login: async (body: {
       username: string;
       password: string;
-      organization?: string;
     }): Promise<{ access_token: string; expires_in: number | null; user: import("../store/auth").AuthUser }> => {
       const res = await request<{
         data: {
@@ -1477,6 +1613,7 @@ export const apiV26 = {
             role_label: string | null;
             project_id: string | null;
             project_name: string | null;
+            projects?: { id: string; name: string }[];
           };
         };
       }>("/auth/login", { method: "POST", body: JSON.stringify(body) });
@@ -1508,6 +1645,7 @@ export const apiV26 = {
         id: string; casdoor_id: string; first_name: string; last_name: string; phone: string | null;
         role: "pm" | "procurement_manager" | "admin" | null; role_label: string | null;
         project_id: string | null; project_name: string | null;
+        projects?: { id: string; name: string }[];
       }>("/users/me");
       return {
         id: data.id,
@@ -1519,9 +1657,13 @@ export const apiV26 = {
         role_label: data.role_label,
         project_id: data.project_id,
         project_name: data.project_name,
+        projects: data.projects ?? [],
         display_name: `${data.first_name} ${data.last_name}`.trim() || data.casdoor_id,
       };
     },
+    // پروژه‌های تخصیص‌یافته به کاربر جاری (PM) — مبنای سوییچر پروژه + اعتبارسنجی
+    myProjects: async (): Promise<{ id: string; name: string }[]> =>
+      getData<{ id: string; name: string }[]>("/users/me/projects"),
     // --- Organization panel (admin / procurement manager) ---
     list: async (): Promise<UserRow[]> => {
       const data = await getData<UserRow[]>("/users");
@@ -1544,33 +1686,44 @@ export const apiV26 = {
     },
   },
 
+  // 1:N تخصیص مدیر پروژه ↔ پروژه: هر پروژه حداکثر یک PM دارد؛
+  // pm_user_id=null یعنی جداسازی مدیر از پروژه. فقط ادمین/مدیر تدارکات.
+  projects: {
+    setPm: async (projectId: string, userId: string | null): Promise<void> => {
+      await patchData(`/projects/${projectId}`, { pm_user_id: userId });
+    },
+  },
+
   warehouses: {
     list: async (projectId?: string): Promise<Warehouse[]> => {
-      const qs = projectId ? `?project_id=${projectId}&page_size=100` : "?page_size=100";
+      const pid = projectId ?? activeProjectId() ?? undefined;
+      const qs = pid ? `?project_id=${pid}&page_size=100` : "?page_size=100";
       const data = await getData<Parameters<typeof rawWarehouse>[0][]>(`/inventory/warehouses${qs}`);
       return data.map(rawWarehouse);
     },
     create: async (body: { project_id: string; name: string; description?: string | null }): Promise<Warehouse> => {
-      const d = await postData<Parameters<typeof rawWarehouse>[0]>("/inventory/warehouses", body);
+      const d = await postData<Parameters<typeof rawWarehouse>[0]>(`/inventory/warehouses${projectQuery()}`, body);
       return rawWarehouse(d);
     },
     update: async (id: string, body: { name?: string; description?: string | null; project_id?: string }): Promise<Warehouse> => {
-      const d = await patchData<Parameters<typeof rawWarehouse>[0]>(`/inventory/warehouses/${id}`, body);
+      const d = await patchData<Parameters<typeof rawWarehouse>[0]>(`/inventory/warehouses/${id}${projectQuery()}`, body);
       return rawWarehouse(d);
     },
     delete: async (id: string): Promise<void> => {
-      await deleteData(`/inventory/warehouses/${id}`);
+      await deleteData(`/inventory/warehouses/${id}${projectQuery()}`);
     },
   },
 
   inventory: {
     list: async (params: { project_id?: string; category_id?: string; warehouse_id?: string; material_id?: string; sort?: string } = {}): Promise<InventoryRow[]> => {
-      const qs = new URLSearchParams({ page_size: "100", ...cleanParams(params) }).toString();
+      const pid = params.project_id ?? activeProjectId() ?? undefined;
+      const qs = new URLSearchParams({ page_size: "100", ...cleanParams({ ...params, project_id: pid }) }).toString();
       const data = await getData<Parameters<typeof rawInventory>[0][]>(`/inventory?${qs}`);
       return data.map(rawInventory);
     },
     transactions: async (params: { project_id?: string; warehouse_id?: string; transaction_type?: string; date_from?: string; date_to?: string; sort?: string } = {}): Promise<InventoryTransaction[]> => {
-      const qs = new URLSearchParams({ page_size: "100", ...cleanParams(params) }).toString();
+      const pid = params.project_id ?? activeProjectId() ?? undefined;
+      const qs = new URLSearchParams({ page_size: "100", ...cleanParams({ ...params, project_id: pid }) }).toString();
       return getData<InventoryTransaction[]>(`/inventory/transactions?${qs}`);
     },
     createTransaction: async (body: {
@@ -1579,26 +1732,34 @@ export const apiV26 = {
       physical_qty?: number | null; unit_id?: number | null; specs?: Record<string, string> | null;
       note?: string | null; transaction_date?: string | null;
     }): Promise<InventoryTransaction[]> => {
-      return postData<InventoryTransaction[]>("/inventory/transactions", body);
+      return postData<InventoryTransaction[]>(`/inventory/transactions${projectQuery()}`, body);
     },
     types: async (): Promise<{ type: TransactionType; label: string }[]> => {
       return getData<{ type: TransactionType; label: string }[]>("/inventory/meta/types");
     },
     materialOptions: async (category_id: string, warehouse_id?: string): Promise<{ id: string; name: string; brands: { id: string; name: string }[] }[]> => {
-      const qs = warehouse_id ? `?category_id=${category_id}&warehouse_id=${warehouse_id}` : `?category_id=${category_id}`;
-      return getData<{ id: string; name: string; brands: { id: string; name: string }[] }[]>(`/inventory/materials/options${qs}`);
+      const params: Record<string, string> = { category_id };
+      if (warehouse_id) params.warehouse_id = warehouse_id;
+      const pid = activeProjectId();
+      if (pid) params.project_id = pid;
+      return getData<{ id: string; name: string; brands: { id: string; name: string }[] }[]>(
+        `/inventory/materials/options?${new URLSearchParams(params).toString()}`,
+      );
     },
   },
 
   pm: {
-    onTheWay: async (): Promise<PendingArrival[]> => getData<PendingArrival[]>("/pm/on-the-way"),
+    // پروژه فعال به‌صورت صریح ارسال می‌شود؛ بک‌اند تعلق آن به PM را بررسی می‌کند
+    onTheWay: async (projectId?: string | null): Promise<PendingArrival[]> =>
+      getData<PendingArrival[]>(projectId ? `/pm/on-the-way?project_id=${projectId}` : "/pm/on-the-way"),
     confirmReceipt: async (body: {
       item_decision_id: string; received_qty: number;
       allocations: { warehouse_id: string; quantity: number }[];
       received_at?: string | null; on_time?: boolean | null; quality_note?: string | null;
-    }): Promise<{ receipt_id: string; state: string; posted_transactions: string[] }> =>
-      postData("/pm/receipts", body),
-    receipts: async (): Promise<ConfirmedReceipt[]> => getData<ConfirmedReceipt[]>("/pm/receipts"),
+    }, projectId?: string | null): Promise<{ receipt_id: string; state: string; posted_transactions: string[] }> =>
+      postData(projectId ? `/pm/receipts?project_id=${projectId}` : "/pm/receipts", body),
+    receipts: async (projectId?: string | null): Promise<ConfirmedReceipt[]> =>
+      getData<ConfirmedReceipt[]>(projectId ? `/pm/receipts?project_id=${projectId}` : "/pm/receipts"),
   },
 
   // ساخت موجودیت‌های کاتالوگ سراسری از داخل پنل انبار (موجودی اولیه):

frontend/src/lib/jalali.ts

@@ -99,8 +99,11 @@ export const MONTHS = [
 
 export const WEEKDAYS = ["ش", "ی", "د", "س", "چ", "پ", "ج"];
 
-function toEnSafe(s: string): string {
-  return String(s).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)));
+export function toAsciiDigits(s: string | number | null | undefined): string {
+  if (s == null) return "";
+  return String(s)
+    .replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)))
+    .replace(/[٠-٩]/g, (d) => String("٠١٢٣٤٥٦٧٨٩".indexOf(d)));
 }
 
 // format an ISO (gregorian) string to "۱۴۰۳/۰۵/۱۲"
@@ -121,16 +124,29 @@ export function isoToJalaliLong(iso: string | null | undefined): string {
   return `${toFa(jd)} ${MONTHS[jm - 1]} ${toFa(jy)}`;
 }
 
-// parse a jalali "yyyy/m/d" string to a JS Date (gregorian) at local midnight
+// parse a jalali "yyyy/m/d" or "yyyy/m/d h:m" string to a JS Date (gregorian) ISO string
 export function jalaliStrToIso(str: string | null | undefined): string | null {
   if (!str) return null;
-  const nums = String(str)
-    .split(/[/\-.]/)
-    .map((x) => parseInt(toEnSafe(x), 10));
-  if (nums.length < 3 || nums.some((n) => Number.isNaN(n))) return null;
-  const [jy, jm, jd] = nums;
+  const s = toAsciiDigits(str).trim();
+  const m = s.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
+  if (!m) {
+    const nums = s
+      .split(/[/\-.]/)
+      .map((x) => parseInt(x, 10));
+    if (nums.length < 3 || nums.some((n) => Number.isNaN(n))) return null;
+    const [jy, jm, jd] = nums;
+    const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
+    const dt = new Date(gy, gm - 1, gd);
+    return Number.isNaN(dt.getTime()) ? null : dt.toISOString();
+  }
+  const jy = parseInt(m[1], 10);
+  const jm = parseInt(m[2], 10);
+  const jd = parseInt(m[3], 10);
+  const h = m[4] != null ? parseInt(m[4], 10) : 0;
+  const min = m[5] != null ? parseInt(m[5], 10) : 0;
+  const sec = m[6] != null ? parseInt(m[6], 10) : 0;
   const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
-  const dt = new Date(gy, gm - 1, gd);
+  const dt = new Date(gy, gm - 1, gd, h, min, sec);
   return Number.isNaN(dt.getTime()) ? null : dt.toISOString();
 }
 

frontend/src/lib/quoteUtils.ts

@@ -40,20 +40,58 @@ export function specsLabel(specs: string[]): string {
   return specs.join(" · ");
 }
 
-// نام نمایشی متریال — نام سراسری واقعی (materials.name)، نه دسته.
-// برند و مشخصه فقط وقتی به نام اضافه می‌شوند که داخلش نیامده باشند (بدون تکرار).
-export function materialLabel(m: Pick<Material, "name" | "brand" | "specs" | "category">): string {
-  const name = (m.name || "").trim();
-  const specs = (m.specs || []).filter(Boolean);
-  if (!name && !m.brand && !specs.length) return m.category === "؟" ? "؟" : "کالا";
-  if (!name) {
-    return [m.brand, ...specs].filter(Boolean).join(" ") || "کالا";
+/**
+ * عنوان تمیز و بدون تکرار کالا:
+ * ترکیب هوشمندانه‌ی نام اصلی (materials.name)، برند، و مشخصه‌ها بدون تکرار کلمات مشترک.
+ */
+export function formatMaterialTitle(
+  m: Pick<Material, "name" | "brand" | "specs" | "category"> | null | undefined,
+  extraSpecs?: string[],
+): string {
+  if (!m) return "کالا";
+  const rawName = (m.name || "").trim();
+  const rawBrand = (m.brand || "").trim();
+  const rawSpecs = [...(m.specs || []), ...(extraSpecs || [])]
+    .map((s) => (s || "").trim())
+    .filter(Boolean);
+
+  const normName = normalize(rawName);
+  const normBrand = normalize(rawBrand);
+
+  if (!rawName) {
+    if (rawBrand && rawSpecs.length) return `${rawBrand} · ${rawSpecs.join(" · ")}`;
+    if (rawBrand) return rawBrand;
+    if (rawSpecs.length) return rawSpecs.join(" · ");
+    return m.category && m.category !== "؟" ? m.category : "کالا";
   }
-  const parts = [name];
-  if (m.brand && !name.includes(m.brand)) parts.push(m.brand);
-  const missing = specs.filter((s) => !name.includes(s));
-  if (missing.length) parts.push(`(${missing.join("، ")})`);
-  return parts.join(" ");
+
+  let title = rawName;
+  if (normBrand && !normName.includes(normBrand)) {
+    title = `${rawBrand} ${title}`;
+  }
+
+  const normTitle = normalize(title);
+  const distinctSpecs: string[] = [];
+  const seenNormSpecs = new Set<string>();
+
+  for (const s of rawSpecs) {
+    const ns = normalize(s);
+    if (!ns || seenNormSpecs.has(ns)) continue;
+    seenNormSpecs.add(ns);
+
+    // اگر مشخصه قبلاً داخل عنوان یا نام کالا آمده باشد، تکرار نمی‌کنیم
+    if (normTitle.includes(ns)) continue;
+    distinctSpecs.push(s);
+  }
+
+  if (distinctSpecs.length > 0) {
+    return `${title} · ${distinctSpecs.join(" · ")}`;
+  }
+  return title;
+}
+
+export function materialLabel(m: Pick<Material, "name" | "brand" | "specs" | "category"> | null | undefined): string {
+  return formatMaterialTitle(m);
 }
 
 // آرایه‌ی termsheet_ids یک قلم (هر دو فرمت قدیم/جدید)
@@ -104,9 +142,15 @@ export function lineItemTotal(li: LineItem): number | null {
   return null;
 }
 
-// پروژه‌های یک قلم — فقط پروژه‌های تخصیص‌یافته به همین قلم (بدون fallback به سطح پیشنهاد)
-export function itemProjects(_q: Quote, li: LineItem): string[] {
-  return (li.projects || []).map((p) => (typeof p === "string" ? p : p.name));
+// پروژه‌های یک قلم:
+// - در وضعیت offered: تمام پروژه‌های کاندیدا (line_item_projects)
+// - در وضعیت accepted یا arrived: فقط تک پروژه‌ی انتخاب‌شده در خرید (item_decisions.project_id)
+export function itemProjects(q: Quote, li: LineItem): string[] {
+  if (q.status === "accepted" || q.status === "arrived") {
+    return li.target_project?.name ? [li.target_project.name] : [];
+  }
+  // For 'offered', 'rejected', 'expired': return all candidate projects
+  return (li.projects || []).map((p) => (typeof p === "string" ? p : p.name)).filter(Boolean);
 }
 
 // ---------- واحد مرجع و ضریب تبدیل ----------
@@ -163,8 +207,24 @@ export function unitWarning(_store: Store, _q: Quote): { unit: string; cat: stri
   return [];
 }
 
-// ستون پروژه
+// ستون پروژه:
+// در وضعیت‌های پذیرفته‌شده یا رسیده، فقط پروژه‌های هدف خرید اقلام نشان داده می‌شوند
 export function projectCell(q: Quote): string {
+  if (q.status === "accepted" || q.status === "arrived") {
+    const targets = (q.line_items || [])
+      .filter((li) => !li.rejected)
+      .map((li) =>
+        li.target_project?.name ||
+        (li.projects && li.projects.length === 1
+          ? typeof li.projects[0] === "string"
+            ? li.projects[0]
+            : li.projects[0].name
+          : null),
+      )
+      .filter(Boolean) as string[];
+    const unique = [...new Set(targets)];
+    if (unique.length) return unique.join("، ");
+  }
   if (q.projects && q.projects.length) return q.projects.join("، ");
   return q.project || "—";
 }

frontend/src/lib/types.ts

@@ -71,7 +71,9 @@ export interface LineItem {
   arrived_date: string | null; // تاریخ آخرین رسید
   received_qty?: number | null; // مجموع رسیدهای ثبت‌شده (رسید جزیی) — null = هنوز داده‌ای نیست
   received_warehouses?: { id: string; name: string; quantity: number }[] | null; // انبارهای مقصد رسیدها
-  projects?: { id: string; name: string }[]; // پروژه‌های تخصیص‌یافته به این قلم
+  projects?: { id: string; name: string }[]; // پروژه‌های کاندیدای تخصیص‌یافته به این قلم (line_item_projects)
+  target_project?: { id: string; name: string } | null; // پروژه‌ی نهایی انتخاب‌شده در هنگام خرید (item_decisions.project_id)
+  target_project_id?: string | null;
 }
 
 // پیشنهاد خرید (اصلی‌ترین entity)

frontend/src/main.tsx

@@ -6,6 +6,7 @@ import { Toaster } from "sonner";
 import App from "./App";
 import "./styles/globals.css";
 import { queryClient } from "./lib/queryClient";
+import { initAnalytics } from "./lib/analytics";
 
 // بعد از استقرار نسخه‌ی جدید، مرورگری که index.html قدیمی را باز کرده برای
 // بارگذاری chunkهای حذف‌شده 404 می‌گیرد و صفحه خالی می‌ماند. این شنونده،
@@ -15,6 +16,9 @@ window.addEventListener("vite:preloadError", () => {
   window.location.reload();
 });
 
+// Product analytics + GlitchTip error capture — no-ops without VITE_ config.
+initAnalytics();
+
 createRoot(document.getElementById("root")!).render(
   <StrictMode>
     <QueryClientProvider client={queryClient}>

frontend/src/pages/Auth/LoginPage.tsx

@@ -1,14 +1,15 @@
 import { useEffect, useMemo, useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { toast } from "sonner";
-import { ClipboardList, Loader2, Lock, ShieldCheck, Wrench, X } from "lucide-react";
+import { ClipboardList, Eye, EyeOff, Loader2, Lock, ShieldCheck, Wrench, X } from "lucide-react";
 import { api, apiV26 } from "../../lib/api";
+import { identifyUser, track } from "../../lib/analytics";
 import { useAuthStore } from "../../store/auth";
 import type { Project } from "../../lib/types";
 
 // ============================================================
 // ورود به سامانه — Casdoor درون‌صفحه‌ای (بدون ریدایرکت)
-// فرم اصلی: Username / Password / Organization (اختیاری) →
+// فرم اصلی: Username / Password →
 //   POST /api/v1/auth/login (بک‌اند با grant_type=password از
 //   Casdoor توکن می‌گیرد و نقش را از جدول users خودمان برمی‌گرداند)
 // حالت توسعه (فقط ادمین — سوپر یوزر) — چرخه‌ی ۳ مرحله‌ای:
@@ -36,7 +37,7 @@ export function LoginPage() {
   // ---- فرم اصلی (Casdoor) ----
   const [username, setUsername] = useState("");
   const [password, setPassword] = useState("");
-  const [organization, setOrganization] = useState("");
+  const [showPassword, setShowPassword] = useState(false);
   const [loading, setLoading] = useState(false);
 
   // ---- پنل حالت توسعه (۳ مرحله) ----
@@ -71,7 +72,6 @@ export function LoginPage() {
       const { access_token, user } = await apiV26.auth.login({
         username: username.trim(),
         password,
-        ...(organization.trim() ? { organization: organization.trim() } : {}),
       });
       if (!user.role) {
         toast.error("نقش شما هنوز در سیستم تعیین نشده است — با مدیر سیستم تماس بگیرید");
@@ -79,6 +79,9 @@ export function LoginPage() {
       }
       setToken(access_token);
       setUser(user);
+      // تحلیل رفتار (no-op بدون تنظیمات VITE_OPENPANEL_*)
+      identifyUser({ id: user.id, name: user.display_name, role: user.role });
+      track("login_success", { role: user.role });
       toast.success(`خوش آمدید، ${user.display_name}`);
       // مدیر پروژه → پنل انبار؛ مدیر تدارکات/ادمین → دفتر پیشنهادهای خرید
       navigate(user.role === "pm" ? "/inventory" : "/");
@@ -101,7 +104,6 @@ export function LoginPage() {
       const { user: adminUser } = await apiV26.auth.login({
         username: devAdminUser.trim(),
         password: devAdminPass,
-        ...(organization.trim() ? { organization: organization.trim() } : {}),
       });
       if (adminUser.role !== "admin") {
         toast.error("حالت توسعه فقط برای ادمین (سوپر یوزر) در دسترس است");
@@ -298,30 +300,33 @@ export function LoginPage() {
               <label className="mb-1 block text-[12px] font-semibold text-muted" htmlFor="login-password">
                 رمز عبور
               </label>
-              <input
-                id="login-password"
-                type="password"
-                autoComplete="current-password"
-                dir="ltr"
-                className="h-10 w-full rounded-lg border border-line bg-panel px-3 text-left text-sm shadow-sm placeholder:text-muted/60 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                placeholder="••••••"
-                value={password}
-                onChange={(e) => setPassword(e.target.value)}
-              />
-            </div>
-            <div className="field">
-              <label className="mb-1 block text-[12px] font-semibold text-muted" htmlFor="login-org">
-                سازمان (اختیاری)
-              </label>
-              <input
-                id="login-org"
-                type="text"
-                dir="ltr"
-                className="h-10 w-full rounded-lg border border-line bg-panel px-3 text-left text-sm shadow-sm placeholder:text-muted/60 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                placeholder="inventory"
-                value={organization}
-                onChange={(e) => setOrganization(e.target.value)}
-              />
+              <div className="relative">
+                <input
+                  id="login-password"
+                  type={showPassword ? "text" : "password"}
+                  autoComplete="current-password"
+                  dir="ltr"
+                  className="h-10 w-full rounded-lg border border-line bg-panel px-3 pr-10 text-left text-sm shadow-sm placeholder:text-muted/60 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+                  placeholder="••••••"
+                  value={password}
+                  onChange={(e) => setPassword(e.target.value)}
+                />
+                <button
+                  type="button"
+                  onClick={() => setShowPassword((v) => !v)}
+                  aria-label={showPassword ? "Hide password" : "Show password"}
+                  aria-pressed={showPassword}
+                  aria-controls="login-password"
+                  title={showPassword ? "پنهان کردن رمز" : "نمایش رمز"}
+                  className="absolute inset-y-0 right-0 flex cursor-pointer items-center rounded-lg px-3 text-muted transition-colors hover:text-ink focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+                >
+                  {showPassword ? (
+                    <EyeOff className="h-4 w-4" aria-hidden="true" />
+                  ) : (
+                    <Eye className="h-4 w-4" aria-hidden="true" />
+                  )}
+                </button>
+              </div>
             </div>
             <button
               type="submit"

frontend/src/pages/Dashboard/AcceptModal.tsx

@@ -5,11 +5,9 @@ import { api, nextDashedId } from "../../lib/api";
 import { useMaterials, useProjects, useQuotes, useUpdateQuote, useSuppliers } from "../../hooks";
 import {
   activeItems,
+  formatMaterialTitle,
   itemTermsheetIds,
   materialById,
-  materialLabel,
-  materialSpecs,
-  specsLabel,
   supplierById,
 } from "../../lib/quoteUtils";
 import { faNum, fmtNum } from "../../lib/formatters";
@@ -76,11 +74,13 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
     const projSel: Record<string, string> = {};
     q.line_items.forEach((li) => {
       const names = (li.projects || []).map((p) => p.name).filter(Boolean);
-      projSel[li.id] = names.length
-        ? names[0]
-        : q.projects && q.projects.length
-          ? q.projects[0]
-          : q.project || "";
+      projSel[li.id] = li.target_project?.name
+        ? li.target_project.name
+        : names.length
+          ? names[0]
+          : q.projects && q.projects.length
+            ? q.projects[0]
+            : q.project || "";
     });
     setItemProjectsSel(projSel);
     setReady(true);
@@ -219,17 +219,14 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
       if (t.status === "accepted" && !usedIds.has(t.id)) t.status = "offered";
     });
 
-    // پروژه‌ی هر قلم (تکی) + همگام‌سازی پروژه‌های سطح پیشنهاد
-    const projUnion = new Set<string>();
+    // پروژه‌ی هر قلم (تکی هدف خرید) — فقط target_project تنظیم می‌شود؛
+    // li.projects و next.projects دست‌نخورده باقی می‌مانند تا پروژه‌های کاندیدای اولیه حفظ شوند
     next.line_items.forEach((li) => {
       if (li.rejected) return;
       const name = itemProjectsSel[li.id];
       if (name === undefined) return;
-      li.projects = name ? [{ id: "", name }] : [];
-      if (name) projUnion.add(name);
+      li.target_project = name ? { id: "", name } : null;
     });
-    next.projects = [...projUnion];
-    next.project = next.projects[0] || "";
 
     const now = new Date().toISOString();
     next.accepted_date = acceptDate || now;
@@ -298,7 +295,6 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
             {allItems.map((li) => {
               const removed = removedItems.has(li.id);
               const m = materialById(materials, li.material_id);
-              const specText = specsLabel(materialSpecs(m));
               return (
                 <div key={li.id} className={`accept-item-assign-row ${removed ? "rejected" : ""}`}>
                   <input
@@ -314,8 +310,7 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                     }}
                   />
                   <span className="flex-1 text-[13px]">
-                    {materialLabel(m)}
-                    {specText ? ` · ${specText}` : ""}
+                    {formatMaterialTitle(m)}
                   </span>
                   <span className="text-[12px] text-muted">
                     {fmtNum(li.quantity)} {li.unit} × {groupCommas(li.unit_price, true)}
@@ -351,14 +346,12 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
               .filter((li) => !removedItems.has(li.id))
               .map((li) => {
                 const m = materialById(materials, li.material_id);
-                const specText = specsLabel(materialSpecs(m));
                 return (
                   <div key={li.id} className="rounded-lg border border-line p-2.5">
                     <div className="mb-1.5 text-[12.5px]">
                       <span className="font-semibold">
-                        {materialLabel(m)}
+                        {formatMaterialTitle(m)}
                       </span>
-                      {specText ? <span className="text-muted"> · {specText}</span> : ""}
                       <span className="ms-2 text-[11px] text-muted">
                         {fmtNum(li.quantity)} {li.unit}
                       </span>
@@ -404,7 +397,7 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                 toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
               )
             }
-            urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "invoice", a.id) : null)}
+            onDownload={(a) => api.files.download(q.id, "invoice", a.id!, a.name)}
           />
         </div>
 
@@ -421,7 +414,7 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                 toast.error(err instanceof Error ? err.message : "حذف پیش‌فاکتور ناموفق بود"),
               )
             }
-            urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "proforma", a.id) : null)}
+            onDownload={(a) => api.files.download(q.id, "proforma", a.id!, a.name)}
             label="افزودن پیش‌فاکتور"
           />
         </div>

frontend/src/pages/Dashboard/ArriveModal.tsx

@@ -3,7 +3,7 @@ import { toast } from "sonner";
 import { Package } from "lucide-react";
 import type { Quote } from "../../lib/types";
 import { useMaterials, useQuotes, useSuppliers, useUpdateQuote } from "../../hooks";
-import { activeItems, materialById, materialSpecs, supplierById } from "../../lib/quoteUtils";
+import { activeItems, formatMaterialTitle, materialById, supplierById } from "../../lib/quoteUtils";
 import { fmtNum } from "../../lib/formatters";
 import { groupCommas } from "../../lib/numutil";
 import { Button } from "../../components/ui/button";
@@ -86,7 +86,6 @@ export function ArriveModal({ quoteId, onClose }: ArriveModalProps) {
         <div className="flex flex-col gap-1.5">
           {items.map((li) => {
             const m = materialById(materials, li.material_id);
-            const specText = materialSpecs(m).join(" · ");
             return (
               <label key={li.id} className={`arrive-row${li.arrived_date ? " arrived" : ""}`}>
                 <input
@@ -102,8 +101,7 @@ export function ArriveModal({ quoteId, onClose }: ArriveModalProps) {
                 />
                 <span>
                   <Package className="me-1 inline h-3.5 w-3.5 text-muted" />
-                  {m.category} {m.brand}
-                  {specText ? ` · ${specText}` : ""}
+                  {formatMaterialTitle(m)}
                 </span>
                 <span className="arrive-meta">
                   {fmtNum(li.quantity)} {li.unit || ""} × {groupCommas(li.unit_price, true)}

frontend/src/pages/Dashboard/DashboardPage.tsx

@@ -22,7 +22,6 @@ import { EditModal } from "./EditModal";
 
 const EMPTY_FILTERS: Filters = { category: "", supplier: "", status: "", search: "" };
 
-// صفحه‌ی اصلی دفتر پیشنهادهای خرید
 export function DashboardPage() {
   useStoreData();
 
@@ -46,7 +45,7 @@ export function DashboardPage() {
     [quotes, suppliers, materials, projects, categoryUnits, unitConversions, standardConversions, topics],
   );
 
-  // فیلتر + مرتب‌سازی بر اساس زمان ساخت (created_at) — فیلترها بازنشانی نمی‌شوند
+  // فیلتر + مرتب‌سازی بر اساس زمان ساخت (created_at)
   const filtered = useMemo(() => {
     const list = filterQuotes(store, filters);
     const createdTs = (q: (typeof store.quotes)[number]) => {
@@ -73,33 +72,49 @@ export function DashboardPage() {
   const supplierOptions = useMemo(() => suppliers.map((s) => ({ id: s.id, name: s.name })), [suppliers]);
 
   return (
-    <div className="min-h-screen">
+    <div className="min-h-screen pb-20 md:pb-6">
       <Header
         title="دفتر پیشنهادهای خرید"
         brand
         menu={<AppSwitcherMenu activeModule="procurement" />}
         actions={
-          <>
+          <div className="hidden md:flex items-center gap-2">
             <Link to="/suppliers" className="btn-line-file no-underline">
               <Users className="h-3.5 w-3.5" />
               تأمین‌کننده‌ها
             </Link>
-            <Link to="/projects" className="btn-line-file no-underline">
-              <FolderKanban className="h-3.5 w-3.5" />
-              پروژه‌ها
+
+            {/* دکمه پروژه‌ها */}
+            <Link
+              to="/projects"
+              className="inline-flex items-center gap-1.5 px-3.5 py-2 rounded-xl border border-gray-200 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-gray-700 dark:text-zinc-200 text-xs font-semibold hover:bg-gray-50 dark:hover:bg-zinc-700 shadow-2xs transition-all no-underline"
+            >
+              <FolderKanban className="h-4 w-4 text-gray-500 dark:text-zinc-400" />
+              <span>پروژه‌ها</span>
             </Link>
-            <Link to="/units" className="btn-line-file no-underline">
-              <Ruler className="h-3.5 w-3.5" />
-              ضرایب تبدیل
+
+            {/* دکمه ضرایب تبدیل */}
+            <Link
+              to="/units"
+              className="inline-flex items-center gap-1.5 px-3.5 py-2 rounded-xl border border-gray-200 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-gray-700 dark:text-zinc-200 text-xs font-semibold hover:bg-gray-50 dark:hover:bg-zinc-700 shadow-2xs transition-all no-underline"
+            >
+              <Ruler className="h-4 w-4 text-gray-500 dark:text-zinc-400" />
+              <span>ضرایب تبدیل</span>
             </Link>
-            <Link to="/wizard" className="btn-line-file no-underline bg-accent text-white hover:bg-accent-dark">
-              <Plus className="h-3.5 w-3.5" />
-              افزودن پیشنهاد جدید
+
+            {/* دکمه اصلی: افزودن پیشنهاد جدید */}
+            <Link
+              to="/wizard"
+              className="inline-flex items-center gap-1.5 px-4 py-2 rounded-xl bg-blue-600 hover:bg-blue-700 active:bg-blue-800 text-white text-xs font-semibold shadow-sm hover:shadow transition-all no-underline"
+            >
+              <Plus className="h-4 w-4" />
+              <span>افزودن پیشنهاد جدید</span>
             </Link>
-          </>
+          </div>
         }
       />
-      <PageLayout className="flex flex-col gap-4">
+
+      <PageLayout className="flex flex-col gap-3 px-3 md:px-6">
         <StatsBar
           total={stats.total}
           offered={stats.offered}
@@ -124,8 +139,17 @@ export function DashboardPage() {
         />
       </PageLayout>
 
+      {/* دکمه شناور اکشن (FAB) مخصوص نسخه موبایل */}
+      <Link
+        to="/wizard"
+        aria-label="افزودن پیشنهاد جدید"
+        className="md:hidden fixed bottom-20 left-4 z-40 flex h-14 w-14 items-center justify-center rounded-full bg-accent text-white shadow-xl shadow-accent/30 active:scale-95 transition-transform"
+      >
+        <Plus className="h-7 w-7" />
+      </Link>
+
       <AcceptModal quoteId={acceptId} onClose={() => setAcceptId(null)} />
       <EditModal quoteId={editId} onClose={() => setEditId(null)} />
     </div>
   );
-}
+}

frontend/src/pages/Dashboard/EditModal.tsx

@@ -1,14 +1,16 @@
 import { useEffect, useMemo, useState } from "react";
-import { Trash2 } from "lucide-react";
+import { Trash2, AlertCircle } from "lucide-react";
 import { toast } from "sonner";
 import type { Attachment, LineItem, Milestone, Quote, Termsheet } from "../../lib/types";
 import { api, nextDashedId, nextId } from "../../lib/api";
+import { cn } from "../../lib/utils";
 import {
   useMaterials,
   useProjects,
   useQuotes,
   useSuppliers,
   useUpdateQuote,
+  useDeleteQuote,
   useAddSupplier,
   useAddMaterial,
 } from "../../hooks";
@@ -35,6 +37,7 @@ import {
 interface EditItemRow {
   key: string;
   origLi?: LineItem;
+  projects?: { id: string; name: string }[];
   cat: string;
   brand: string;
   specs: string[];
@@ -59,18 +62,27 @@ export interface EditModalProps {
   onClose: () => void;
 }
 
-// مودال ویرایش کامل پیشنهاد
+// مودال ویرایش کامل پیشنهاد — بهینه‌شده برای صفحات موبایل
 export function EditModal({ quoteId, onClose }: EditModalProps) {
   const quotes = useQuotes();
   const suppliers = useSuppliers();
   const materials = useMaterials();
   const projects = useProjects();
   const updateQuote = useUpdateQuote();
+  const deleteQuote = useDeleteQuote();
   const addSupplier = useAddSupplier();
   const addMaterial = useAddMaterial();
 
   const q = useMemo(() => quotes.find((x) => x.id === quoteId) || null, [quotes, quoteId]);
 
+  const hasReceipts = useMemo(() => {
+    if (!q) return false;
+    if (q.status === "arrived") return true;
+    return (q.line_items || []).some(
+      (li) => (li.received_qty != null && li.received_qty > 0) || !!li.arrived_date,
+    );
+  }, [q]);
+
   const [ready, setReady] = useState(false);
   const [supplierName, setSupplierName] = useState("");
   const [selectedProjects, setSelectedProjects] = useState<string[]>([]);
@@ -83,16 +95,46 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
   const [acceptedDate, setAcceptedDate] = useState<string | null>(null);
   const [arrivedDate, setArrivedDate] = useState<string | null>(null);
   const [status, setStatus] = useState("offered");
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+
+  const handleDelete = async () => {
+    if (!q) return;
+    setDeleting(true);
+    try {
+      await deleteQuote.mutateAsync(q.id);
+      toast.success("پیشنهاد خرید با موفقیت حذف شد");
+      setShowDeleteConfirm(false);
+      onClose();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "حذف پیشنهاد ناموفق بود");
+    } finally {
+      setDeleting(false);
+    }
+  };
+
+  // گزینه‌های مشخصه
+  const [globalSpecs, setGlobalSpecs] = useState<string[]>([]);
+  useEffect(() => {
+    let alive = true;
+    void api
+      .specsList()
+      .then((list) => alive && setGlobalSpecs(list))
+      .catch(() => {});
+    return () => {
+      alive = false;
+    };
+  }, []);
 
-  // گزینه‌های مشخصه — همه‌ی مشخصه‌های ثبت‌شده (کش)
   const specOptions = useMemo(() => {
     const set = new Set<string>();
+    globalSpecs.forEach((s) => s && set.add(s));
     materials.forEach((m) => (m.specs || []).forEach((s) => s && set.add(s)));
     itemRows.forEach((r) => r.specs.forEach((s) => s && set.add(s)));
     return [...set].sort((a, b) => a.localeCompare(b, "fa"));
-  }, [materials, itemRows]);
+  }, [materials, itemRows, globalSpecs]);
 
-  // گزینه‌های پروژه — پروژه‌های ثبت‌شده + پروژه‌های خود پیشنهاد
+  // گزینه‌های پروژه
   const projectOptions = useMemo(() => {
     const set = new Set<string>();
     projects.forEach((p) => p.name && set.add(p.name));
@@ -107,7 +149,17 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     if (!q) return;
     const sup = supplierById(suppliers, q.supplier_id);
     setSupplierName(sup.name);
-    setSelectedProjects(q.projects && q.projects.length ? [...q.projects] : q.project ? [q.project] : []);
+    // حفظ تمام پروژه‌های کاندیدا: اتحاد پروژه‌های سطح پیشنهاد و پروژه‌های کاندیدای هر قلم
+    const candidateSet = new Set<string>();
+    (q.projects || []).forEach((p) => p && candidateSet.add(p));
+    if (q.project) candidateSet.add(q.project);
+    q.line_items.forEach((li) => {
+      (li.projects || []).forEach((p) => {
+        const n = typeof p === "string" ? p : p.name;
+        if (n) candidateSet.add(n);
+      });
+    });
+    setSelectedProjects([...candidateSet]);
     setNotes(q.notes || "");
     setItemRows(
       q.line_items.map((li) => {
@@ -115,6 +167,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         return {
           key: li.id,
           origLi: li,
+          projects: li.projects && li.projects.length ? [...li.projects] : [],
           cat: m.category || "",
           brand: m.brand || "",
           specs: materialSpecs(m),
@@ -144,7 +197,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     setReady(true);
   }, [q, suppliers, materials]);
 
-  // فاکتورها مستقیماً از سرور (MinIO) خوانده می‌شوند — نه از state محلی
+  // بارگذاری فاکتورها
   useEffect(() => {
     if (!quoteId) return;
     let alive = true;
@@ -204,9 +257,14 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
   };
 
   const confirm = async () => {
+    if (hasReceipts && status !== q.status) {
+      toast.error("این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.");
+      return;
+    }
+
     const next: Quote = JSON.parse(JSON.stringify(q));
 
-    // تأمین‌کننده — موجود یا جدید
+    // تأمین‌کننده
     if (supplierName.trim()) {
       const norm = normalize(supplierName);
       const exist = suppliers.find((s) => normalize(s.name) === norm);
@@ -215,7 +273,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       } else {
         const newSup = { id: nextId("s", suppliers), name: supplierName.trim(), location: "", phone: "", contact: "", topic: "", categories: [] };
         const created = await addSupplier.mutateAsync(newSup);
-        next.supplier_id = created.id; // UUID واقعی از بک‌اند
+        next.supplier_id = created.id;
       }
     }
 
@@ -224,7 +282,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     next.notes = notes.trim();
     next.invoices = invoices;
 
-    // termsheetها — id موجود حفظ می‌شود، جدیدها ساخته می‌شوند
+    // termsheetها
     const tsIdMap: Record<string, string> = {};
     const newTermsheets: Termsheet[] = [];
     tsCards.forEach((card, i) => {
@@ -252,7 +310,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       const qty = row.qty;
       const price = row.price;
       const total = row.total;
-      if (!cat && !brand && qty == null && price == null) continue; // ردیف خالی
+      if (!cat && !brand && qty == null && price == null) continue;
 
       let material = materialsCopy.find(
         (m) =>
@@ -266,7 +324,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       } else {
         const nm = {
           id: nextId("m", materialsCopy),
-          name: [brand, cat, ...specs].filter(Boolean).join(" ") || "کالای جدید",
+          name: (cat || brand || specs.join(" ") || "").trim() || "کالای جدید",
           topic: materialById(materials, row.origLi?.material_id || "").topic || "",
           category: cat,
           brand,
@@ -274,7 +332,6 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
           base_unit: unit,
         };
         materialsCopy.push(nm);
-        // منتظر ساخت متریال می‌مانیم تا id واقعی (UUID) به قلم وصل شود
         const created = await addMaterial.mutateAsync(nm);
         materialId = created.id;
       }
@@ -304,8 +361,15 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         acceptedTsId = null;
       }
 
+      const candProjs =
+        row.projects && row.projects.length
+          ? row.projects
+          : row.origLi?.projects && row.origLi.projects.length
+            ? row.origLi.projects
+            : selectedProjects.map((pname) => ({ id: "", name: pname }));
+
       newItems.push({
-        id: "li-" + (newItems.length + 1),
+        id: row.origLi ? row.origLi.id : row.key.startsWith("new-") ? row.key : "li-" + (newItems.length + 1),
         material_id: materialId,
         quantity: qty,
         unit,
@@ -315,12 +379,13 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         accepted_ts_id: acceptedTsId,
         rejected,
         arrived_date: row.origLi?.arrived_date ?? null,
-        projects: row.origLi?.projects ?? [],
+        projects: candProjs,
+        target_project: status === "offered" ? null : (row.origLi?.target_project ?? null),
+        target_project_id: status === "offered" ? null : (row.origLi?.target_project_id ?? null),
       });
     }
     next.line_items = newItems.length ? newItems : next.line_items;
 
-    // ترم‌شیت بدون قلم بی‌معنی است — حذف
     const referencedTs = new Set<string>();
     next.line_items.forEach((li) => (li.termsheet_ids || []).forEach((tid) => referencedTs.add(tid)));
     next.termsheets = next.termsheets.filter((t) => referencedTs.has(t.id));
@@ -332,12 +397,11 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
 
     // تاریخ‌ها و وضعیت
     next.quote_date = quoteDate || q.quote_date;
-    next.expiry_date = expiryDate || "";
+    next.expiry_date = expiryDate ? (expiryDate.length > 10 ? expiryDate.slice(0, 10) : expiryDate) : "";
     next.accepted_date = acceptedDate;
     next.arrived_date = arrivedDate;
     next.status = status as Quote["status"];
 
-    // پاک‌سازی خودکار در بازگشت وضعیت
     if (next.status === "offered") {
       next.accepted_date = null;
       next.arrived_date = null;
@@ -348,6 +412,8 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         li.rejected = false;
         li.arrived_date = null;
         li.accepted_ts_id = null;
+        li.target_project = null;
+        li.target_project_id = null;
       });
     } else if (next.status === "accepted") {
       next.arrived_date = null;
@@ -367,292 +433,396 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
   };
 
   return (
-    <Dialog open={!!quoteId} onOpenChange={(o) => !o && onClose()}>
-      <DialogContent className="max-w-3xl">
-        <DialogHeader>
-          <DialogTitle>ویرایش پیشنهاد</DialogTitle>
-        </DialogHeader>
+    <>
+      <Dialog open={!!quoteId} onOpenChange={(o) => !o && onClose()}>
+        <DialogContent className="max-h-[92vh] w-[95vw] max-w-3xl overflow-y-auto p-3.5 sm:p-6">
+          <DialogHeader>
+            <DialogTitle className="text-base font-bold sm:text-lg">ویرایش پیشنهاد</DialogTitle>
+          </DialogHeader>
 
-        <div className="grid grid-cols-2 gap-3 max-md:grid-cols-1">
-          <div className="field">
-            <label>تأمین‌کننده</label>
-            <Combobox
-              value={supplierName}
-              onChange={(it: { id: string; label: string }) => setSupplierName(it.label)}
-              items={suppliers.map((s) => ({ id: s.id, name: s.name }))}
-              allowAdd
-              addSuffix="به عنوان تأمین‌کنندهٔ جدید"
-              placeholder="نام تأمین‌کننده"
-              onInputChange={(v) => setSupplierName(v)}
-            />
-          </div>
-          <div className="field">
-            <label>پروژه</label>
-            <MultiSelectCombobox
-              values={selectedProjects}
-              onChange={setSelectedProjects}
-              options={projectOptions}
-              placeholder="انتخاب پروژه..."
-            />
-          </div>
-          <div className="field col-span-2">
-            <label>یادداشت</label>
-            <textarea
-              rows={2}
-              className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-              value={notes}
-              onChange={(e) => setNotes(e.target.value)}
-            />
-          </div>
-        </div>
+          {hasReceipts && (
+            <div className="flex items-center gap-2 rounded-lg border border-amber/30 bg-amber-bg px-3 py-2 text-[12px] font-medium text-amber">
+              <AlertCircle className="h-4 w-4 shrink-0" />
+              <span>این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.</span>
+            </div>
+          )}
 
-        {/* اقلام */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-2 text-[13px] font-bold">اقلام سفارش:</div>
-          <div className="flex flex-col gap-3">
-            {itemRows.map((row) => (
-              <div key={row.key} className={`rounded-lg border p-3 ${row.rejected ? "border-dashed border-line opacity-60" : "border-line"}`}>
-                <div className="grid grid-cols-2 gap-3 md:grid-cols-4">
-                  <div className="field">
-                    <label>متریال</label>
-                    <input
-                      className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                      placeholder="متریال"
-                      value={row.cat}
-                      onChange={(e) => patchItem(row.key, { cat: e.target.value })}
-                    />
+          {/* اطلاعات بالایی — تک‌ستونه در موبایل، ۲ ستونه در دسکتاپ */}
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <div className="flex min-w-0 flex-col gap-1.5">
+              <label className="text-xs font-semibold text-muted">تأمین‌کننده</label>
+              <div className="w-full min-w-0">
+                <Combobox
+                  value={supplierName}
+                  onChange={(it: { id: string; label: string }) => setSupplierName(it.label)}
+                  items={suppliers.map((s) => ({ id: s.id, name: s.name }))}
+                  allowAdd
+                  addSuffix="به عنوان تأمین‌کنندهٔ جدید"
+                  placeholder="نام تأمین‌کننده"
+                  onInputChange={(v) => setSupplierName(v)}
+                />
+              </div>
+            </div>
+
+            <div className="flex min-w-0 flex-col gap-1.5">
+              <label className="text-xs font-semibold text-muted">پروژه</label>
+              <div className="w-full min-w-0">
+                <MultiSelectCombobox
+                  values={selectedProjects}
+                  onChange={setSelectedProjects}
+                  options={projectOptions}
+                  placeholder="انتخاب پروژه..."
+                />
+              </div>
+            </div>
+
+            <div className="col-span-1 flex min-w-0 flex-col gap-1.5 sm:col-span-2">
+              <label className="text-xs font-semibold text-muted">یادداشت</label>
+              <textarea
+                rows={2}
+                className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+                value={notes}
+                onChange={(e) => setNotes(e.target.value)}
+              />
+            </div>
+          </div>
+
+          {/* اقلام */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-2 text-[13px] font-bold">اقلام سفارش:</div>
+            <div className="flex flex-col gap-3">
+              {itemRows.map((row) => (
+                <div
+                  key={row.key}
+                  className={`rounded-xl border p-3 sm:rounded-lg ${row.rejected ? "border-dashed border-line opacity-60" : "border-line bg-panel/50"}`}
+                >
+                  <div className="grid grid-cols-2 gap-2.5 sm:grid-cols-3 md:grid-cols-4">
+                    {/* متریال — تمام‌عرض در موبایل */}
+                    <div className="col-span-2 flex min-w-0 flex-col gap-1 sm:col-span-1">
+                      <label className="text-[11px] font-semibold text-muted">متریال</label>
+                      <input
+                        disabled={hasReceipts}
+                        className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                        placeholder="متریال"
+                        value={row.cat}
+                        onChange={(e) => patchItem(row.key, { cat: e.target.value })}
+                      />
+                    </div>
+
+                    {/* برند */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">برند</label>
+                      <input
+                        disabled={hasReceipts}
+                        className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                        placeholder="برند"
+                        value={row.brand}
+                        onChange={(e) => patchItem(row.key, { brand: e.target.value })}
+                      />
+                    </div>
+
+                    {/* واحد */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">واحد</label>
+                      <input
+                        disabled={hasReceipts}
+                        className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                        placeholder="واحد"
+                        value={row.unit}
+                        onChange={(e) => patchItem(row.key, { unit: e.target.value })}
+                      />
+                    </div>
+
+                    {/* مشخصه — تمام‌عرض در موبایل */}
+                    <div className="col-span-2 flex min-w-0 flex-col gap-1 sm:col-span-1 md:col-span-1">
+                      <label className="text-[11px] font-semibold text-muted">مشخصه</label>
+                      <div className="w-full min-w-0">
+                        <MultiSelectCombobox
+                          disabled={hasReceipts}
+                          values={row.specs}
+                          onChange={(specs) => patchItem(row.key, { specs })}
+                          options={specOptions}
+                          placeholder="مشخصه"
+                        />
+                      </div>
+                    </div>
+
+                    {/* تعداد */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">تعداد</label>
+                      <NumberInput
+                        disabled={hasReceipts}
+                        value={row.qty}
+                        onChange={(qty) => {
+                          patchItem(row.key, {
+                            qty,
+                            total: qty != null && row.price != null ? Math.round(qty * row.price * 100) / 100 : row.total,
+                          });
+                        }}
+                        placeholder="تعداد"
+                      />
+                    </div>
+
+                    {/* قیمت واحد */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">قیمت واحد</label>
+                      <NumberInput
+                        disabled={hasReceipts}
+                        value={row.price}
+                        onChange={(price) => {
+                          patchItem(row.key, {
+                            price,
+                            total: row.qty != null && price != null ? Math.round(row.qty * price * 100) / 100 : row.total,
+                          });
+                        }}
+                        placeholder="قیمت واحد"
+                        maxDecimals={2}
+                      />
+                    </div>
+
+                    {/* قیمت کل */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">قیمت کل</label>
+                      <NumberInput
+                        disabled={hasReceipts}
+                        value={row.total}
+                        onChange={(t) => {
+                          patchItem(row.key, {
+                            total: t,
+                            price:
+                              t != null && row.qty != null && row.qty > 0 ? Math.round((t / row.qty) * 100) / 100 : row.price,
+                          });
+                        }}
+                        placeholder="قیمت کل"
+                      />
+                    </div>
+
+                    {/* دکمه حذف */}
+                    <div className="col-span-1 flex items-end justify-end pb-0.5">
+                      {!hasReceipts && (
+                        <button
+                          type="button"
+                          className="inline-flex h-9 items-center gap-1 rounded-md px-2.5 text-xs text-red hover:bg-red-bg/50 transition-colors"
+                          title="حذف قلم"
+                          onClick={() => setItemRows((rows) => rows.filter((r) => r.key !== row.key))}
+                        >
+                          <Trash2 className="h-3.5 w-3.5" />
+                          <span>حذف قلم</span>
+                        </button>
+                      )}
+                    </div>
                   </div>
-                  <div className="field">
-                    <label>برند</label>
-                    <input
-                      className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                      placeholder="برند"
-                      value={row.brand}
-                      onChange={(e) => patchItem(row.key, { brand: e.target.value })}
-                    />
-                  </div>
-                  <div className="field">
-                    <label>مشخصه</label>
-                    <MultiSelectCombobox
-                      values={row.specs}
-                      onChange={(specs) => patchItem(row.key, { specs })}
-                      options={specOptions}
-                      placeholder="مشخصه"
-                    />
-                  </div>
-                  <div className="field">
-                    <label>واحد</label>
-                    <input
-                      className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                      placeholder="واحد"
-                      value={row.unit}
-                      onChange={(e) => patchItem(row.key, { unit: e.target.value })}
-                    />
-                  </div>
-                  <div className="field">
-                    <label>تعداد</label>
-                    <NumberInput
-                      value={row.qty}
-                      onChange={(qty) => {
-                        patchItem(row.key, {
-                          qty,
-                          total: qty != null && row.price != null ? Math.round(qty * row.price * 100) / 100 : row.total,
-                        });
-                      }}
-                      placeholder="تعداد"
-                    />
-                  </div>
-                  <div className="field">
-                    <label>قیمت واحد</label>
-                    <NumberInput
-                      value={row.price}
-                      onChange={(price) => {
-                        patchItem(row.key, {
-                          price,
-                          total: row.qty != null && price != null ? Math.round(row.qty * price * 100) / 100 : row.total,
-                        });
-                      }}
-                      placeholder="قیمت واحد"
-                      maxDecimals={2}
-                    />
-                  </div>
-                  <div className="field">
-                    <label>قیمت کل</label>
-                    <NumberInput
-                      value={row.total}
-                      onChange={(t) => {
-                        patchItem(row.key, {
-                          total: t,
-                          price:
-                            t != null && row.qty != null && row.qty > 0 ? Math.round((t / row.qty) * 100) / 100 : row.price,
-                        });
-                      }}
-                      placeholder="قیمت کل"
-                    />
-                  </div>
-                  <div className="flex items-end justify-end">
-                    <button
-                      type="button"
-                      className="inline-flex items-center gap-1 rounded-md px-2 py-1.5 text-[12px] text-muted transition-colors hover:bg-red-bg hover:text-red"
-                      title="حذف قلم"
-                      onClick={() => setItemRows((rows) => rows.filter((r) => r.key !== row.key))}
-                    >
-                      <Trash2 className="h-3.5 w-3.5" />
-                      حذف
-                    </button>
+
+                  {/* تخصیص termsheet */}
+                  <div className="mt-2.5 border-t border-line/60 pt-2">
+                    {row.rejected ? (
+                      <label className="ts-cb-label e-restore">
+                        <input
+                          type="checkbox"
+                          checked={row.restore}
+                          onChange={(e) => patchItem(row.key, { restore: e.target.checked })}
+                        />
+                        بازگرداندن به معامله
+                      </label>
+                    ) : (
+                      <>
+                        <div className="mb-1 text-[10.5px] font-semibold text-muted">این قلم تحت کدام termsheet هاست؟</div>
+                        <div className="flex flex-wrap gap-1.5">
+                          {tsCards.map((card, idx) => (
+                            <label key={card.key} className={cn("chip cursor-pointer text-xs", hasReceipts && "cursor-not-allowed opacity-60")}>
+                              <input
+                                type="checkbox"
+                                disabled={hasReceipts}
+                                className="me-1 accent-accent disabled:cursor-not-allowed"
+                                checked={row.tsDomIds.includes(card.domId || card.key)}
+                                onChange={(e) => {
+                                  const next = new Set(row.tsDomIds);
+                                  const domId = card.domId || card.key;
+                                  if (e.target.checked) next.add(domId);
+                                  else next.delete(domId);
+                                  patchItem(row.key, { tsDomIds: [...next] });
+                                }}
+                              />
+                              {tsLabel(card, idx)}
+                            </label>
+                          ))}
+                        </div>
+                      </>
+                    )}
                   </div>
                 </div>
-                {/* تخصیص termsheet / بازگرداندن */}
-                <div className="mt-2.5 border-t border-line pt-2">
-                  {row.rejected ? (
-                    <label className="ts-cb-label e-restore">
-                      <input
-                        type="checkbox"
-                        checked={row.restore}
-                        onChange={(e) => patchItem(row.key, { restore: e.target.checked })}
+              ))}
+            </div>
+            {!hasReceipts && (
+              <Button variant="line" size="sm" className="mt-2.5 w-full sm:w-auto" onClick={addItemRow}>
+                ＋ افزودن قلم
+              </Button>
+            )}
+          </div>
+
+          {/* termsheetها */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-2 text-[13px] font-bold">termsheet ها (شرایط پرداخت):</div>
+            <div className="flex flex-col gap-2.5">
+              {tsCards.map((card, idx) => (
+                <div key={card.key} className="variant-card">
+                  <div className="variant-head">
+                    <span className="variant-num">{tsLabel(card, idx)}</span>
+                    {!hasReceipts && (
+                      <button type="button" className="variant-x" title="حذف" onClick={() => removeTsCard(card.key)}>
+                        ×
+                      </button>
+                    )}
+                  </div>
+                  <div className="mb-1 flex flex-col gap-1.5">
+                    {card.milestones.map((ms, i) => (
+                      <MilestoneRow
+                        key={i}
+                        milestone={ms}
+                        disabled={hasReceipts}
+                        onChange={(nextMs) =>
+                          updateTs(card.key, { milestones: card.milestones.map((x, j) => (j === i ? nextMs : x)) })
+                        }
+                        onRemove={() => updateTs(card.key, { milestones: card.milestones.filter((_, j) => j !== i) })}
                       />
-                      بازگرداندن به معامله
-                    </label>
-                  ) : (
-                    <>
-                      <div className="mb-1 text-[10.5px] font-semibold text-muted">این قلم تحت کدام termsheet هاست؟</div>
-                      <div className="flex flex-wrap gap-1.5">
-                        {tsCards.map((card, idx) => (
-                          <label key={card.key} className="chip cursor-pointer">
-                            <input
-                              type="checkbox"
-                              className="me-1 accent-accent"
-                              checked={row.tsDomIds.includes(card.domId || card.key)}
-                              onChange={(e) => {
-                                const next = new Set(row.tsDomIds);
-                                const domId = card.domId || card.key;
-                                if (e.target.checked) next.add(domId);
-                                else next.delete(domId);
-                                patchItem(row.key, { tsDomIds: [...next] });
-                              }}
-                            />
-                            {tsLabel(card, idx)}
-                          </label>
-                        ))}
-                      </div>
-                    </>
+                    ))}
+                  </div>
+                  {!hasReceipts && (
+                    <Button
+                      variant="line"
+                      size="sm"
+                      className="mt-1"
+                      onClick={() => updateTs(card.key, { milestones: [...card.milestones, { when_iso: null, amount: null }] })}
+                    >
+                      ＋ مرحله پرداخت
+                    </Button>
                   )}
                 </div>
-              </div>
-            ))}
+              ))}
+            </div>
+            {!hasReceipts && (
+              <Button variant="line" size="sm" className="mt-2.5 w-full sm:w-auto" onClick={addTsCard}>
+                ＋ افزودن termsheet
+              </Button>
+            )}
           </div>
-          <Button variant="line" size="sm" className="mt-2" onClick={addItemRow}>
-            ＋ افزودن قلم
-          </Button>
-        </div>
 
-        {/* termsheetها */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-2 text-[13px] font-bold">termsheet ها (شرایط پرداخت):</div>
-          <div className="flex flex-col gap-2">
-            {tsCards.map((card, idx) => (
-              <div key={card.key} className="variant-card">
-                <div className="variant-head">
-                  <span className="variant-num">{tsLabel(card, idx)}</span>
-                  <button type="button" className="variant-x" title="حذف" onClick={() => removeTsCard(card.key)}>
-                    ×
-                  </button>
-                </div>
-                <div className="mb-1 flex flex-col gap-1.5">
-                  {card.milestones.map((ms, i) => (
-                    <MilestoneRow
-                      key={i}
-                      milestone={ms}
-                      onChange={(nextMs) =>
-                        updateTs(card.key, { milestones: card.milestones.map((x, j) => (j === i ? nextMs : x)) })
-                      }
-                      onRemove={() => updateTs(card.key, { milestones: card.milestones.filter((_, j) => j !== i) })}
-                    />
-                  ))}
-                </div>
-                <Button
-                  variant="line"
-                  size="sm"
-                  className="mt-1"
-                  onClick={() => updateTs(card.key, { milestones: [...card.milestones, { when_iso: null, amount: null }] })}
+          {/* فاکتورها */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-1 text-[13px] font-bold">فاکتورهای اصلی (چند فایل):</div>
+            <FileList
+              files={invoices}
+              onChange={setInvoices}
+              upload={(f) => api.files.upload(q.id, "invoice", f)}
+              onDelete={(a) =>
+                a.id &&
+                void api.files.remove(q.id, "invoice", a.id).catch((err) =>
+                  toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
+                )
+              }
+              onDownload={(a) => api.files.download(q.id, "invoice", a.id!, a.name)}
+            />
+          </div>
+
+          {/* تاریخ‌ها و وضعیت */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-2 text-[12px] font-bold text-muted">تاریخ‌ها و وضعیت:</div>
+            <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ پیشنهاد</label>
+                <JalaliDatePicker value={quoteDate} onChange={setQuoteDate} placeholder="تاریخ" withTime />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ انقضا</label>
+                <JalaliDatePicker value={expiryDate} onChange={setExpiryDate} placeholder="تاریخ" />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ پذیرش</label>
+                <JalaliDatePicker value={acceptedDate} onChange={setAcceptedDate} placeholder="تاریخ" withTime />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ رسید</label>
+                <JalaliDatePicker value={arrivedDate} onChange={setArrivedDate} placeholder="تاریخ" withTime />
+              </div>
+              <div className="col-span-1 flex min-w-0 flex-col gap-1.5 sm:col-span-2">
+                <label className="text-xs font-semibold text-muted">وضعیت (فقط بازگشت به مرحله‌های قبل)</label>
+                <select
+                  className="h-10 w-full rounded-lg border border-line bg-panel px-3 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                  value={status}
+                  disabled={hasReceipts}
+                  onChange={(e) => setStatus(e.target.value)}
                 >
-                  ＋ مرحله پرداخت
-                </Button>
+                  {statusOptionsFor(q.status).map((st) => (
+                    <option key={st} value={st}>
+                      {STATUS_LABEL[st]}
+                    </option>
+                  ))}
+                </select>
+                {hasReceipts && (
+                  <div className="mt-1.5 rounded-md bg-amber-bg px-2.5 py-1.5 text-[11.5px] font-medium text-amber">
+                    این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.
+                  </div>
+                )}
               </div>
-            ))}
+            </div>
           </div>
-          <Button variant="line" size="sm" className="mt-2" onClick={addTsCard}>
-            ＋ افزودن termsheet
-          </Button>
-        </div>
 
-        {/* فاکتورها */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-1 text-[13px] font-bold">فاکتورهای اصلی (چند فایل):</div>
-          <FileList
-            files={invoices}
-            onChange={setInvoices}
-            upload={(f) => api.files.upload(q.id, "invoice", f)}
-            onDelete={(a) =>
-              a.id &&
-              void api.files.remove(q.id, "invoice", a.id).catch((err) =>
-                toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
-              )
-            }
-            urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "invoice", a.id) : null)}
-          />
-        </div>
-
-        {/* تاریخ‌ها و وضعیت */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-2 text-[12px] text-muted">تاریخ‌ها و وضعیت:</div>
-          <div className="grid grid-cols-2 gap-3 max-md:grid-cols-1">
-            <div className="field">
-              <label>تاریخ پیشنهاد</label>
-              <JalaliDatePicker value={quoteDate} onChange={setQuoteDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field">
-              <label>تاریخ انقضا</label>
-              <JalaliDatePicker value={expiryDate} onChange={setExpiryDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field">
-              <label>تاریخ پذیرش</label>
-              <JalaliDatePicker value={acceptedDate} onChange={setAcceptedDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field">
-              <label>تاریخ رسید</label>
-              <JalaliDatePicker value={arrivedDate} onChange={setArrivedDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field col-span-2">
-              <label>وضعیت (فقط بازگشت به مرحله‌های قبل)</label>
-              <select
-                className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
-                value={status}
-                disabled={q.status === "arrived"}
-                onChange={(e) => setStatus(e.target.value)}
+          {/* فوتر و دکمه‌های اقدام */}
+          <DialogFooter className="flex flex-col-reverse gap-2 border-t border-line/60 pt-3 sm:flex-row sm:items-center sm:justify-between">
+            {q.status === "offered" ? (
+              <Button
+                type="button"
+                variant="danger"
+                onClick={() => setShowDeleteConfirm(true)}
+                className="w-full gap-1.5 sm:w-auto"
               >
-                {statusOptionsFor(q.status).map((st) => (
-                  <option key={st} value={st}>
-                    {STATUS_LABEL[st]}
-                  </option>
-                ))}
-              </select>
-              {q.status === "arrived" && (
-                <div className="mt-1.5 rounded-md bg-amber-bg px-2.5 py-1.5 text-[11.5px] font-medium text-amber">
-                  به دلیل ثبت ورود اقلام به انبار، امکان تغییر وضعیت پیشنهاد وجود ندارد.
-                </div>
-              )}
+                <Trash2 className="h-4 w-4" />
+                <span>حذف پیشنهاد</span>
+              </Button>
+            ) : (
+              <div />
+            )}
+            <div className="flex w-full items-center gap-2 sm:w-auto sm:justify-end">
+              <Button variant="slate" onClick={onClose} className="flex-1 sm:flex-initial">
+                انصراف
+              </Button>
+              <Button onClick={() => void confirm()} className="flex-1 sm:flex-initial">
+                ذخیره تغییرات
+              </Button>
             </div>
-          </div>
-        </div>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
 
-        <DialogFooter>
-          <Button variant="slate" onClick={onClose}>
-            انصراف
-          </Button>
-          <Button onClick={() => void confirm()}>ذخیره تغییرات</Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
+      {/* مودال تأیید حذف */}
+      <Dialog open={showDeleteConfirm} onOpenChange={(open) => !deleting && setShowDeleteConfirm(open)}>
+        <DialogContent className="z-[60] max-w-md p-4 sm:p-6">
+          <DialogHeader>
+            <DialogTitle>حذف پیشنهاد خرید</DialogTitle>
+          </DialogHeader>
+          <div className="py-2 text-sm text-muted">
+            آیا از حذف کامل این پیشنهاد اطمینان دارید؟ این عملیات غیرقابل بازگشت است.
+          </div>
+          <DialogFooter className="flex items-center justify-end gap-2 pt-2">
+            <Button
+              type="button"
+              variant="slate"
+              onClick={() => setShowDeleteConfirm(false)}
+              disabled={deleting}
+            >
+              انصراف
+            </Button>
+            <Button
+              type="button"
+              variant="danger"
+              onClick={() => void handleDelete()}
+              disabled={deleting}
+            >
+              {deleting ? "در حال حذف..." : "حذف نهایی"}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
   );
-}
+}

frontend/src/pages/Dashboard/FilterToolbar.tsx

@@ -1,3 +1,5 @@
+import { useState } from "react";
+import { SlidersHorizontal, X, ArrowUpDown, RotateCcw } from "lucide-react";
 import { Combobox } from "../../components/Combobox";
 import { STATUS_LABEL, STATUS_ORDER } from "../../lib/constants";
 
@@ -20,67 +22,212 @@ export interface FilterToolbarProps {
   onToggleSort: () => void;
 }
 
-// نوار فیلتر دفتر: ۳ کامبوباکس + جستجوی آزاد + دکمه‌ی مرتب‌سازی ⇅
-export function FilterToolbar({ filters, onChange, categories, suppliers, sortDir, onToggleSort }: FilterToolbarProps) {
+export function FilterToolbar({
+  filters,
+  onChange,
+  categories,
+  suppliers,
+  sortDir,
+  onToggleSort,
+}: FilterToolbarProps) {
+  const [isOpen, setIsOpen] = useState(false);
   const set = (patch: Partial<Filters>) => onChange({ ...filters, ...patch });
 
+  // شمارش تعداد فیلترهای فعال به جز سرچ
+  const activeFilterCount = [filters.category, filters.supplier, filters.status].filter(Boolean).length;
+
+  const clearFilters = () => {
+    onChange({ ...filters, category: "", supplier: "", status: "" });
+  };
+
   return (
-    <div className="flex flex-wrap items-end gap-3">
-      <div className="field min-w-[150px] flex-1">
-        <label>دسته</label>
-        <Combobox
-          value={filters.category}
-          onChange={(it: { id: string; label: string }) => set({ category: it.label })}
-          items={categories}
-          allowAdd={false}
-          placeholder="همه"
-          onInputChange={(v) => set({ category: v })}
-        />
-      </div>
-      <div className="field min-w-[170px] flex-1">
-        <label>تأمین‌کننده</label>
-        <Combobox
-          value={filters.supplier}
-          onChange={(it: { id: string; label: string }) => set({ supplier: it.label })}
-          items={suppliers}
-          allowAdd={false}
-          placeholder="همه"
-          onInputChange={(v) => set({ supplier: v })}
-        />
-      </div>
-      <div className="field min-w-[150px] flex-1">
-        <label>وضعیت</label>
-        <Combobox
-          value={filters.status}
-          onChange={(it: { id: string; label: string }) => set({ status: it.label })}
-          items={STATUS_ITEMS}
-          allowAdd={false}
-          placeholder="همه"
-          onInputChange={(v) => set({ status: v })}
-        />
-      </div>
-      <div className="field min-w-[200px] flex-1">
-        <label>جستجو</label>
-        <input
-          type="search"
-          className="h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm shadow-sm placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-          placeholder="جستجو در نام/برند/پروژه..."
-          value={filters.search}
-          onChange={(e) => set({ search: e.target.value })}
-        />
-      </div>
-      <div className="field min-w-[140px]">
-        <label>ترتیب</label>
+    <>
+      {/* ===== نمای موبایل (صفحه‌نمایش‌های زیر md) ===== */}
+      <div className="flex md:hidden items-center gap-2">
+        {/* اینپوت جستجوی متنی */}
+        <div className="relative flex-1">
+          <input
+            type="search"
+            className="h-10 w-full rounded-xl border border-line bg-panel px-3 text-sm shadow-sm placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+            placeholder="جستجو در نام، برند، پروژه..."
+            value={filters.search}
+            onChange={(e) => set({ search: e.target.value })}
+          />
+        </div>
+
+        {/* دکمه فیلترها با بج تعداد انتخاب‌شده */}
         <button
           type="button"
-          className="inline-flex h-9 w-full items-center justify-center gap-1.5 rounded-lg border border-line bg-panel px-3 text-sm shadow-sm hover:bg-slate-bg"
-          onClick={onToggleSort}
-          title={sortDir === "desc" ? "تغییر به قدیمی‌ترین اول" : "تغییر به جدیدترین اول"}
+          onClick={() => setIsOpen(true)}
+          className={`relative inline-flex h-10 items-center justify-center gap-1.5 rounded-xl border px-3 text-xs font-semibold shadow-sm transition-colors ${
+            activeFilterCount > 0
+              ? "border-accent bg-accent-bg text-accent"
+              : "border-line bg-panel text-ink hover:bg-slate-bg"
+          }`}
+          title="فیلترها"
         >
-          <span aria-hidden className="text-accent">⇅</span>
-          <span>{sortDir === "desc" ? "جدیدترین اول" : "قدیمی‌ترین اول"}</span>
+          <SlidersHorizontal className="h-4 w-4" />
+          <span>فیلتر</span>
+          {activeFilterCount > 0 && (
+            <span className="flex h-5 w-5 items-center justify-center rounded-full bg-accent text-[11px] font-bold text-white">
+              {activeFilterCount}
+            </span>
+          )}
+        </button>
+
+        {/* دکمه تغییر جهت سورت */}
+        <button
+          type="button"
+          onClick={onToggleSort}
+          className="inline-flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-line bg-panel text-ink shadow-sm hover:bg-slate-bg"
+          title={sortDir === "desc" ? "جدیدترین اول" : "قدیمی‌ترین اول"}
+        >
+          <ArrowUpDown className="h-4 w-4 text-accent" />
         </button>
       </div>
-    </div>
+
+      {/* باتم‌شیت کشویی فیلترها برای موبایل */}
+      {isOpen && (
+        <div className="fixed inset-0 z-50 flex flex-col justify-end bg-black/40 backdrop-blur-xs md:hidden">
+          <div className="fixed inset-0" onClick={() => setIsOpen(false)} aria-hidden="true" />
+          <div className="relative z-10 max-h-[85vh] w-full overflow-y-auto rounded-t-2xl border-t border-line bg-panel p-4 shadow-2xl">
+            {/* هدر کشو */}
+            <div className="mb-4 flex items-center justify-between border-b border-line pb-3">
+              <div className="flex items-center gap-2">
+                <SlidersHorizontal className="h-4 w-4 text-accent" />
+                <span className="text-sm font-bold text-ink">فیلترهای پیشرفته</span>
+              </div>
+              <div className="flex items-center gap-3">
+                {activeFilterCount > 0 && (
+                  <button
+                    type="button"
+                    onClick={clearFilters}
+                    className="inline-flex items-center gap-1 text-xs text-rose-500 hover:underline"
+                  >
+                    <RotateCcw className="h-3 w-3" />
+                    پاک کردن
+                  </button>
+                )}
+                <button
+                  type="button"
+                  onClick={() => setIsOpen(false)}
+                  className="rounded-lg p-1 text-muted hover:bg-slate-bg hover:text-ink"
+                  aria-label="بستن"
+                >
+                  <X className="h-5 w-5" />
+                </button>
+              </div>
+            </div>
+
+            {/* دراپ‌داون‌ها داخل کشو */}
+            <div className="flex flex-col gap-3.5">
+              <div className="field">
+                <label className="mb-1 block text-xs font-semibold text-muted">دسته</label>
+                <Combobox
+                  value={filters.category}
+                  onChange={(it: { id: string; label: string }) => set({ category: it.label })}
+                  items={categories}
+                  allowAdd={false}
+                  placeholder="همه دسته‌ها"
+                  onInputChange={(v) => set({ category: v })}
+                />
+              </div>
+
+              <div className="field">
+                <label className="mb-1 block text-xs font-semibold text-muted">تأمین‌کننده</label>
+                <Combobox
+                  value={filters.supplier}
+                  onChange={(it: { id: string; label: string }) => set({ supplier: it.label })}
+                  items={suppliers}
+                  allowAdd={false}
+                  placeholder="همه تأمین‌کنندگان"
+                  onInputChange={(v) => set({ supplier: v })}
+                />
+              </div>
+
+              <div className="field">
+                <label className="mb-1 block text-xs font-semibold text-muted">وضعیت</label>
+                <Combobox
+                  value={filters.status}
+                  onChange={(it: { id: string; label: string }) => set({ status: it.label })}
+                  items={STATUS_ITEMS}
+                  allowAdd={false}
+                  placeholder="همه وضعیت‌ها"
+                  onInputChange={(v) => set({ status: v })}
+                />
+              </div>
+            </div>
+
+            {/* دکمه تأیید و بستن */}
+            <button
+              type="button"
+              onClick={() => setIsOpen(false)}
+              className="mt-5 flex h-11 w-full items-center justify-center rounded-xl bg-accent text-sm font-bold text-white shadow-md shadow-accent/20 active:scale-[0.99]"
+            >
+              مشاهده نتایج
+            </button>
+          </div>
+        </div>
+      )}
+
+      {/* ===== نمای دسکتاپ (md به بالا) ===== */}
+      <div className="hidden md:flex flex-wrap items-end gap-3">
+        <div className="field min-w-[150px] flex-1">
+          <label>دسته</label>
+          <Combobox
+            value={filters.category}
+            onChange={(it: { id: string; label: string }) => set({ category: it.label })}
+            items={categories}
+            allowAdd={false}
+            placeholder="همه"
+            onInputChange={(v) => set({ category: v })}
+          />
+        </div>
+        <div className="field min-w-[170px] flex-1">
+          <label>تأمین‌کننده</label>
+          <Combobox
+            value={filters.supplier}
+            onChange={(it: { id: string; label: string }) => set({ supplier: it.label })}
+            items={suppliers}
+            allowAdd={false}
+            placeholder="همه"
+            onInputChange={(v) => set({ supplier: v })}
+          />
+        </div>
+        <div className="field min-w-[150px] flex-1">
+          <label>وضعیت</label>
+          <Combobox
+            value={filters.status}
+            onChange={(it: { id: string; label: string }) => set({ status: it.label })}
+            items={STATUS_ITEMS}
+            allowAdd={false}
+            placeholder="همه"
+            onInputChange={(v) => set({ status: v })}
+          />
+        </div>
+        <div className="field min-w-[200px] flex-1">
+          <label>جستجو</label>
+          <input
+            type="search"
+            className="h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm shadow-sm placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+            placeholder="جستجو در نام/برند/پروژه..."
+            value={filters.search}
+            onChange={(e) => set({ search: e.target.value })}
+          />
+        </div>
+        <div className="field min-w-[140px]">
+          <label>ترتیب</label>
+          <button
+            type="button"
+            className="inline-flex h-9 w-full items-center justify-center gap-1.5 rounded-lg border border-line bg-panel px-3 text-sm shadow-sm hover:bg-slate-bg"
+            onClick={onToggleSort}
+            title={sortDir === "desc" ? "تغییر به قدیمی‌ترین اول" : "تغییر به جدیدترین اول"}
+          >
+            <span aria-hidden className="text-accent">⇅</span>
+            <span>{sortDir === "desc" ? "جدیدترین اول" : "قدیمی‌ترین اول"}</span>
+          </button>
+        </div>
+      </div>
+    </>
   );
-}
+}

frontend/src/pages/Dashboard/LedgerTable.tsx

@@ -12,7 +12,7 @@ export interface LedgerTableProps {
   onEdit: (id: string) => void;
 }
 
-// دفتر پیشنهادها — فهرست کارت‌ها (هر پیشنهاد یک کارت خوانا)
+// دفتر پیشنهادها — فهرست کارت‌ها (واکنش‌گرا و بهینه برای موبایل)
 export function LedgerTable({
   store,
   quotes,
@@ -23,14 +23,14 @@ export function LedgerTable({
 }: LedgerTableProps) {
   if (!quotes.length) {
     return (
-      <div className="rounded-lg border border-line bg-panel">
+      <div className="rounded-xl border border-line bg-panel p-2 sm:rounded-lg">
         <EmptyState icon={Inbox} text="پیشنهادی مطابق فیلترها یافت نشد" />
       </div>
     );
   }
 
   return (
-    <div className="flex flex-col gap-3">
+    <div className="flex flex-col gap-2.5 sm:gap-3">
       {quotes.map((q) => (
         <QuoteCard
           key={q.id}
@@ -42,9 +42,9 @@ export function LedgerTable({
           onEdit={() => onEdit(q.id)}
         />
       ))}
-      <div className="py-1 text-center text-[11px] text-muted">
+      <div className="px-2 py-3 text-center text-[10.5px] leading-5 text-muted sm:py-1 sm:text-[11px]">
         هشدار «منقضی» = قیمت پیشنهادی از تاریخ انقضا گذشته؛ برای پیش‌بینی قیمت، شمارش نمی‌شود.
       </div>
     </div>
   );
-}
+}

frontend/src/pages/Dashboard/QuoteCard.tsx

@@ -1,5 +1,5 @@
 import { Link } from "react-router-dom";
-import { AlarmClock, ChevronDown, Pencil, TriangleAlert, Building2, Package, CreditCard } from "lucide-react";
+import { AlarmClock, ChevronDown, Pencil, TriangleAlert, Building2, Package, CreditCard, Check } from "lucide-react";
 import type { Quote, Store } from "../../lib/types";
 import {
   isExpired,
@@ -27,16 +27,16 @@ export interface QuoteCardProps {
   onEdit: () => void;
 }
 
-function InfoCell({ label, children }: { label: string; children: React.ReactNode }) {
+function InfoCell({ label, children, className }: { label: string; children: React.ReactNode; className?: string }) {
   return (
-    <div className="min-w-0">
-      <div className="mb-0.5 text-[10.5px] font-semibold text-muted">{label}</div>
-      <div className="min-w-0 text-[13px] leading-6">{children}</div>
+    <div className={cn("min-w-0", className)}>
+      <div className="mb-0.5 text-[10px] font-semibold text-muted sm:text-[10.5px]">{label}</div>
+      <div className="min-w-0 text-xs leading-5 text-ink sm:text-[13px] sm:leading-6">{children}</div>
     </div>
   );
 }
 
-// کارت یک پیشنهاد در دفتر — جایگزین جدول ۱۱ ستونه
+// کارت پیشنهاد خرید — بهینه‌شده برای کاربری سرپا با موبایل
 export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit }: QuoteCardProps) {
   const sup = supplierById(store.suppliers, q.supplier_id);
   const expired = isExpired(q);
@@ -46,22 +46,25 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
   const unitWarns = unitWarning(store, q);
   const summary = itemsSummary(store, q);
 
-  // ستون پذیرش (با ساعت)
+  // ستون / دکمه پذیرش
   let acceptedCell: React.ReactNode;
   if (q.status === "offered") {
     acceptedCell = (
-      <button className="chip chip-act" onClick={onAccept}>
-        پذیرش
+      <button
+        onClick={onAccept}
+        className="inline-flex h-7 items-center justify-center gap-1 rounded-md bg-emerald-600 px-2.5 text-xs font-bold text-white shadow-xs active:scale-95 transition-transform"
+      >
+        <Check className="h-3.5 w-3.5" />
+        <span>پذیرش</span>
       </button>
     );
   } else if (q.accepted_date) {
-    acceptedCell = <span className="tabular-nums">{fmtDateTime(q.accepted_date)}</span>;
+    acceptedCell = <span className="tabular-nums font-medium">{fmtDateTime(q.accepted_date)}</span>;
   } else {
     acceptedCell = <span className="text-muted">—</span>;
   }
 
-  // ستون رسید — v2.6: تأیید رسید فقط در «پنل مدیریت انبار» توسط مدیر پروژه انجام می‌شود؛
-  // اینجا فقط وضعیت نمایش داده می‌شود. با رسید جزیی: «رسیده X از Y» + «در راه Z».
+  // وضعیت رسید کالا
   const activeItems = (q.line_items || []).filter((li) => !li.rejected);
   const receivedSum = activeItems.reduce((s, li) => s + (li.received_qty || 0), 0);
   const orderedSum = activeItems.reduce((s, li) => s + (li.quantity || 0), 0);
@@ -71,25 +74,24 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
   const anyReceived = receivedSum > 0;
   const fullyDelivered = activeItems.length > 0 && fulfilledItems === activeItems.length && anyReceived;
 
-  // نشان پیشرفت تکمیل در هدر کارت (جایگزین نشان وضعیت در حالت پذیرش/رسید):
-  //   در راه (آبی) → رسید: X از Y قلم (کهربایی) → تکمیل شد (سبز)
+  // نشان پیشرفت تکمیل
   let fulfillmentBadge: React.ReactNode = null;
   if (q.status === "accepted" || q.status === "arrived") {
     if (fullyDelivered || q.status === "arrived") {
       fulfillmentBadge = (
-        <span className="inline-flex items-center gap-1 rounded-full border border-emerald-200 bg-emerald-50 px-2 py-0.5 text-[11px] font-bold text-emerald-700">
-          ✓ تکمیل شد
+        <span className="inline-flex items-center gap-1 rounded-full border border-emerald-200 bg-emerald-50 px-2 py-0.5 text-[10.5px] font-bold text-emerald-700 sm:text-[11px]">
+          ✓ تکمیل
         </span>
       );
     } else if (anyReceived) {
       fulfillmentBadge = (
-        <span className="inline-flex items-center gap-1 rounded-full border border-amber-200 bg-amber-50 px-2 py-0.5 text-[11px] font-bold text-amber-700">
-          رسید: {fmtNum(fulfilledItems)} از {fmtNum(activeItems.length)} قلم
+        <span className="inline-flex items-center gap-1 rounded-full border border-amber-200 bg-amber-50 px-2 py-0.5 text-[10.5px] font-bold text-amber-700 sm:text-[11px]">
+          رسید: {fmtNum(fulfilledItems)}/{fmtNum(activeItems.length)}
         </span>
       );
     } else {
       fulfillmentBadge = (
-        <span className="inline-flex items-center gap-1 rounded-full border border-blue-200 bg-blue-50 px-2 py-0.5 text-[11px] font-bold text-blue-700">
+        <span className="inline-flex items-center gap-1 rounded-full border border-blue-200 bg-blue-50 px-2 py-0.5 text-[10.5px] font-bold text-blue-700 sm:text-[11px]">
           ⏳ در راه
         </span>
       );
@@ -97,19 +99,12 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
   }
 
   let arrivedCell: React.ReactNode;
-  // آخرین لحظه‌ی رسید ثبت‌شده بین قلم‌ها (رسیدهای جزیی توسط مدیر پروژه)
   const lastReceiptAt = activeItems.reduce<Date | null>((acc, li) => {
     if (!li.arrived_date) return acc;
     const t = new Date(li.arrived_date).getTime();
     if (Number.isNaN(t)) return acc;
     return !acc || t > acc.getTime() ? new Date(li.arrived_date) : acc;
   }, null);
-  const receiptTimeLine =
-    lastReceiptAt != null ? (
-      <span className="block text-[10.5px] font-normal text-muted">
-        آخرین رسید: {fmtDateTime(lastReceiptAt.toISOString())}
-      </span>
-    ) : null;
 
   if (q.status === "accepted") {
     if (q.arrived_date) {
@@ -117,12 +112,11 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
     } else if (receivedSum > 0) {
       arrivedCell = (
         <span className="tabular-nums">
-          رسیده {fmtNum(receivedSum)} از {fmtNum(orderedSum)} — در راه {fmtNum(Math.max(0, orderedSum - receivedSum))}
-          {receiptTimeLine}
+          {fmtNum(receivedSum)} از {fmtNum(orderedSum)}
         </span>
       );
     } else {
-      arrivedCell = <span className="text-muted">در انتظار PM</span>;
+      arrivedCell = <span className="text-muted">در انتظار انبار</span>;
     }
   } else if (q.status === "arrived") {
     arrivedCell = (
@@ -137,37 +131,44 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
   return (
     <div
       className={cn(
-        "overflow-hidden rounded-lg border bg-panel transition-colors",
+        "overflow-hidden rounded-xl border bg-panel transition-colors shadow-2xs sm:rounded-lg",
         expired ? "border-amber/40" : "border-line hover:border-accent/40",
-        expanded && "border-accent/60",
+        expanded && "border-accent/60 ring-1 ring-accent/20",
       )}
     >
       {/* سربرگ کارت */}
-      <div className="flex items-center gap-3 border-b border-line bg-bg/40 px-4 py-2.5">
-        <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-lg bg-accent-bg text-sm font-bold text-accent-dark">
+      <div className="flex items-center gap-2.5 border-b border-line bg-bg/40 px-3 py-2 sm:gap-3 sm:px-4 sm:py-2.5">
+        <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-accent-bg text-xs font-bold text-accent-dark sm:h-9 sm:w-9 sm:text-sm">
           {sup.name.slice(0, 1)}
         </span>
-        <div className="min-w-0">
+        <div className="min-w-0 flex-1">
           <Link
             to={`/suppliers/${q.supplier_id}`}
-            className="block truncate text-[13.5px] font-bold text-ink no-underline hover:text-accent"
+            className="block truncate text-xs font-bold text-ink no-underline hover:text-accent sm:text-[13.5px]"
           >
             {sup.name}
           </Link>
-          {sup.location && <div className="truncate text-[11px] text-muted">{sup.location}</div>}
+          {sup.location && <div className="truncate text-[10px] text-muted sm:text-[11px]">{sup.location}</div>}
         </div>
-        <div className="ms-auto flex shrink-0 items-center gap-1.5">
+        <div className="ms-auto flex shrink-0 items-center gap-1 sm:gap-1.5">
           {fulfillmentBadge ?? (
-            <Badge variant={q.status as "offered" | "accepted" | "arrived"}>{STATUS_LABEL[q.status]}</Badge>
+            <Badge variant={q.status as "offered" | "accepted" | "arrived"} className="text-[10px] sm:text-xs">
+              {STATUS_LABEL[q.status]}
+            </Badge>
           )}
-          <button className="chip" onClick={onEdit} title="ویرایش پیشنهاد">
+          <button
+            className="chip h-7 px-2 sm:h-auto sm:px-2.5"
+            onClick={onEdit}
+            title="ویرایش پیشنهاد"
+            aria-label="ویرایش"
+          >
             <Pencil className="h-3 w-3" />
-            ویرایش
+            <span className="hidden sm:inline">ویرایش</span>
           </button>
           <button
-            className="chip chip-expand"
+            className="chip chip-expand h-7 w-7 p-0 sm:h-auto sm:w-auto sm:p-1.5"
             onClick={onToggleExpand}
-            title={expanded ? "جمع کردن" : "نمایش جریان"}
+            title={expanded ? "جمع کردن" : "نمایش جزئیات"}
             aria-expanded={expanded}
           >
             <ChevronDown className={cn("h-4 w-4 transition-transform duration-200", expanded && "rotate-180")} />
@@ -175,75 +176,120 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         </div>
       </div>
 
-      {/* اطلاعات کلیدی */}
-      <div className="grid grid-cols-2 gap-x-5 gap-y-3 px-4 py-3 md:grid-cols-4">
-        <InfoCell label="اقلام">
+      {/* اطلاعات کلیدی — چیدمان بهینه‌شده موبایل */}
+      <div className="grid grid-cols-2 gap-x-3 gap-y-3 p-3 sm:gap-x-5 sm:gap-y-3.5 sm:p-4 md:grid-cols-4">
+        {/* ۱. پروژه — تمام‌عرض در موبایل */}
+        <InfoCell label="پروژه" className="col-span-2 md:col-span-1">
+          <div className="flex items-center gap-1.5 text-xs font-semibold text-ink sm:text-[13px]">
+            <Building2 className="h-3.5 w-3.5 shrink-0 text-muted" />
+            <span className="truncate">
+              {q.projects && q.projects.length > 0 ? q.projects.join("، ") : projectCell(q)}
+            </span>
+          </div>
+        </InfoCell>
+
+        {/* ۲. اقلام — تمام‌عرض زیر پروژه با شکستن متن بدون سه‌نقطه */}
+        <InfoCell label="اقلام" className="col-span-2 md:col-span-1">
           {summary.count > 1 ? (
-            <div className="flex flex-col gap-0.5">
-              <span className="font-semibold">{fmtNum(summary.count)} قلم</span>
-              <div className="flex flex-col gap-1 text-[11.5px] leading-5 text-muted">
-                {store.quotes.find((x) => x.id === q.id)?.line_items?.filter((li) => !li.rejected).map((li) => {
-                  const m = materialById(store.materials, li.material_id);
-                  return (
-                    <span key={li.id} className="flex items-center gap-1">
-                      <span className="h-1.5 w-1.5 shrink-0 rounded-full bg-accent/40" />
-                      {materialLabel(m)}
-                      <span className="text-[10px] text-muted/70">
-                        {fmtNum(li.quantity)} {li.unit}
-                      </span>
-                    </span>
-                  );
-                })}
+            <div className="flex flex-col gap-1.5">
+              <span className="font-bold text-xs text-ink sm:text-sm">
+                {fmtNum(summary.count)} قلم کالا
+              </span>
+              <div className="flex flex-col gap-1.5 rounded-lg border border-line/60 bg-bg/50 p-2.5 text-[11px] leading-5 text-muted sm:text-[11.5px]">
+                {store.quotes
+                  .find((x) => x.id === q.id)
+                  ?.line_items?.filter((li) => !li.rejected)
+                  .slice(0, 3)
+                  .map((li) => {
+                    const m = materialById(store.materials, li.material_id);
+                    return (
+                      <div
+                        key={li.id}
+                        className="flex items-start justify-between gap-2 border-b border-line/30 pb-1.5 last:border-0 last:pb-0"
+                      >
+                        <span className="min-w-0 flex-1 font-medium text-ink leading-snug break-words">
+                          • {materialLabel(m)}
+                        </span>
+                        <span className="shrink-0 font-semibold tabular-nums text-ink text-[10.5px] pt-0.5">
+                          {fmtNum(li.quantity)}{" "}
+                          <span className="font-normal text-muted text-[9.5px]">{li.unit}</span>
+                        </span>
+                      </div>
+                    );
+                  })}
+                {(q.line_items?.length || 0) > 3 && (
+                  <span className="pt-0.5 text-[10px] text-muted">
+                    و {(q.line_items?.length || 0) - 3} قلم دیگر...
+                  </span>
+                )}
               </div>
             </div>
           ) : (
-            summary.text
+            <div className="flex items-start gap-1.5 text-xs font-medium leading-5 text-ink sm:text-[13px]">
+              <span className="break-words">{summary.text}</span>
+            </div>
           )}
+
           {unitWarns.map((w) => (
             <Link
               key={w.unit}
               to={`/units?cat=${encodeURIComponent(w.cat)}&unit=${encodeURIComponent(w.unit)}`}
-              className="unit-warn mt-1"
+              className="unit-warn mt-1 inline-flex items-center gap-1 text-[10px]"
               title={`ضریب تبدیل «${esc(w.unit)}» را در داشبورد واحدها ثبت کنید`}
             >
-              <TriangleAlert className="h-2.5 w-2.5" />
+              <TriangleAlert className="h-2.5 w-2.5 shrink-0" />
               واحد جدید: {w.unit}
             </Link>
           ))}
         </InfoCell>
 
         <InfoCell label="پروژه">
-          <span className="inline-flex items-center gap-1.5">
+          <span className="inline-flex items-center gap-1 text-xs sm:text-[13px]">
             <Building2 className="h-3.5 w-3.5 shrink-0 text-muted" />
-            {q.projects && q.projects.length > 0 ? (
-              <span className="flex flex-col gap-0.5">
-                {q.projects.map((p, i) => (
-                  <span key={i}>{p}</span>
-                ))}
-              </span>
-            ) : (
-              projectCell(q)
-            )}
+            <span className="truncate">
+              {(() => {
+                const activeItems = (q.line_items || []).filter((li) => !li.rejected);
+                if (q.status === "accepted" || q.status === "arrived") {
+                  // فقط پروژه‌ی هدف پذیرفته‌شده — همان منطق itemProjects در وضعیت accepted
+                  const targetProj = activeItems.find((li) => li.target_project)?.target_project;
+                  return targetProj?.name ?? projectCell(q);
+                }
+                // وضعیت offered: همه‌ی پروژه‌های کاندیدا از line_items (همان منطق itemProjects)
+                const names = new Set<string>();
+                activeItems.forEach((li) =>
+                  (li.projects || []).forEach((p) => {
+                    const name = typeof p === "string" ? p : p.name;
+                    if (name) names.add(name);
+                  })
+                );
+                if (names.size > 0) return [...names].join("، ");
+                return projectCell(q);
+              })()}
+            </span>
           </span>
         </InfoCell>
 
-        <InfoCell label="مجموع">
+        <InfoCell label="مجموع مبلغ" className="col-span-1">
           {pc ? (
-            <span className="font-bold tabular-nums">
-              {pc.num} <span className="num-words">({pc.words} تومان)</span>
-            </span>
+            <div>
+              <div className="text-sm font-extrabold tabular-nums text-ink sm:text-base">
+                {pc.num} <span className="text-[10px] font-normal text-muted sm:text-xs">تومان</span>
+              </div>
+              <div className="hidden text-[11px] text-muted sm:block">({pc.words})</div>
+            </div>
           ) : (
             "—"
           )}
         </InfoCell>
 
-        <InfoCell label="معامله">
+        {/* ۴. شرایط معامله */}
+        <InfoCell label="شرایط معامله" className="col-span-1">
           {ts.title !== "—" ? (
             <div>
-              <div className="font-semibold" style={ts.color ? { color: ts.color } : undefined}>
+              <div className="text-xs font-semibold sm:text-[13px]" style={ts.color ? { color: ts.color } : undefined}>
                 {ts.title}
               </div>
-              {ts.sub && <div className="text-[11px] text-muted">{ts.sub}</div>}
+              {ts.sub && <div className="truncate text-[10px] text-muted sm:text-[11px]">{ts.sub}</div>}
             </div>
           ) : (
             <span className="text-muted">—</span>
@@ -251,30 +297,36 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         </InfoCell>
       </div>
 
-      {/* تاریخ‌ها و اقدامات */}
-      <div className="flex flex-wrap items-center gap-x-5 gap-y-2 border-t border-line bg-bg/40 px-4 py-2 text-[11.5px] text-muted">
-        <span className="inline-flex items-center gap-1.5">
-          <Package className="h-3 w-3" />
-          پیشنهاد: <b className="text-ink tabular-nums">{fmtDateTime(q.quote_date)}</b>
+      {/* تاریخ‌ها و اکشن‌ها */}
+      <div className="grid grid-cols-2 gap-2 border-t border-line bg-bg/40 p-2.5 text-[11px] text-muted sm:flex sm:flex-wrap sm:items-center sm:gap-x-5 sm:gap-y-2 sm:px-4 sm:py-2 sm:text-[11.5px]">
+        <span className="inline-flex items-center gap-1.5 truncate">
+          <Package className="h-3 w-3 shrink-0" />
+          <span>تاریخ:</span>
+          <b className="tabular-nums text-ink">{fmtDate(q.quote_date)}</b>
         </span>
-        <span className="inline-flex items-center gap-1.5">
-          <CreditCard className="h-3 w-3" />
-          معتبر تا:{" "}
+
+        <span className="inline-flex items-center gap-1.5 truncate">
+          <CreditCard className="h-3 w-3 shrink-0" />
+          <span>اعتبار:</span>
           <b className={cn("tabular-nums", expired ? "text-amber" : "text-ink")}>
             {fmtDate(q.expiry_date)}
           </b>
-          {expired && <AlarmClock className="h-3 w-3 text-amber" aria-label="منقضی" />}
+          {expired && <AlarmClock className="h-3 w-3 shrink-0 text-amber" aria-label="منقضی" />}
         </span>
+
         <span className="inline-flex items-center gap-1.5">
-          پذیرش: {acceptedCell}
+          <span>پذیرش:</span>
+          {acceptedCell}
         </span>
-        <span className="inline-flex items-center gap-1.5">
-          رسید: {arrivedCell}
+
+        <span className="inline-flex items-center gap-1.5 truncate">
+          <span>رسید:</span>
+          {arrivedCell}
         </span>
       </div>
 
-      {/* جریان (expand) */}
+      {/* جزئیات تکمیلی بازشونده */}
       {expanded && <QuoteDetail store={store} q={q} />}
     </div>
   );
-}
+}

frontend/src/pages/Dashboard/QuoteDetail.tsx

@@ -3,13 +3,11 @@ import { Package, Scale, CreditCard, CalendarDays, Paperclip, Building2, Ban } f
 import type { Attachment, Quote, Store } from "../../lib/types";
 import { api } from "../../lib/api";
 import {
+  formatMaterialTitle,
   itemTermsheetIds,
   lineItemTotal,
   materialById,
-  materialLabel,
-  materialSpecs,
   refConverted,
-  specsLabel,
 } from "../../lib/quoteUtils";
 import { fmtDate, fmtDateTime, fmtNum } from "../../lib/formatters";
 import { groupCommas } from "../../lib/numutil";
@@ -69,7 +67,6 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
     const total = lineItemTotal(li);
     const projs = itemProjects(q, li);
     const conv = isRejected ? null : refConverted(store, li);
-    const specText = specsLabel(materialSpecs(m));
 
     // رسید جزیی → قلم به دو بخش «رسید شده» و «در راه» شکسته می‌شود (نمایشی):
     // مجموع دو بخش همیشه با تعداد/مبلغ اصلی برابر است (عدم تغییر جمع کل پیشنهاد).
@@ -97,8 +94,7 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
       >
         <div className="fb-name">
           <Package className="me-1 inline h-3 w-3 text-muted" />
-          {materialLabel(m)}
-          {specText ? ` · ${specText}` : ""}
+          {formatMaterialTitle(m)}
         </div>
         <div className="fb-meta">
           <Building2 className="me-1 inline h-3 w-3" /> {projs.length ? projs.join("، ") : "—"}
@@ -148,19 +144,31 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
   attachments.proformas.forEach((pf, i) => {
     if (!pf.id) return;
     attachParts.push(
-      <a key={"pf" + i} className="detail-link" href={api.files.downloadUrl(q.id, "proforma", pf.id)} download={pf.name}>
+      <button
+        key={"pf" + i}
+        type="button"
+        className="detail-link"
+        title="دانلود پیش‌فاکتور"
+        onClick={() => api.files.download(q.id, "proforma", pf.id!, pf.name)}
+      >
         <Paperclip className="me-1 inline h-3 w-3" />
         پیش‌فاکتور: {pf.name}
-      </a>,
+      </button>,
     );
   });
   attachments.invoices.forEach((inv, i) => {
     if (!inv.id) return;
     attachParts.push(
-      <a key={"inv" + i} className="detail-link" href={api.files.downloadUrl(q.id, "invoice", inv.id)} download={inv.name}>
+      <button
+        key={"inv" + i}
+        type="button"
+        className="detail-link"
+        title="دانلود فاکتور"
+        onClick={() => api.files.download(q.id, "invoice", inv.id!, inv.name)}
+      >
         <Paperclip className="me-1 inline h-3 w-3" />
         فاکتور اصلی: {inv.name}
-      </a>,
+      </button>,
     );
   });
 

frontend/src/pages/Dashboard/QuoteRow.tsx

@@ -2,10 +2,10 @@ import { Link } from "react-router-dom";
 import { AlarmClock, ChevronDown, TriangleAlert } from "lucide-react";
 import type { Quote, Store } from "../../lib/types";
 import {
+  formatMaterialTitle,
   isExpired,
   itemsSummary,
   materialById,
-  materialSpecs,
   projectCell,
   quoteTotal,
   supplierById,
@@ -92,11 +92,10 @@ export function QuoteRow({ store, q, expanded, onToggleExpand, onAccept, onEdit
               <div className="flex flex-col gap-0.5 text-[11px] text-muted">
                 {(q.line_items || []).filter((li) => !li.rejected).map((li) => {
                   const m = materialById(store.materials, li.material_id);
-                  const specs = materialSpecs(m);
                   return (
                     <span key={li.id} className="flex items-center gap-1">
                       <span className="h-1.5 w-1.5 shrink-0 rounded-full bg-accent/40" />
-                      {m.category} {m.brand}{specs.length ? ` · ${specs.join(" · ")}` : ""}
+                      {formatMaterialTitle(m)}
                       <span className="text-[10px] text-muted/70">
                         {fmtNum(li.quantity)} {li.unit}
                       </span>

frontend/src/pages/Inventory/ArrivalsPage.tsx

@@ -33,9 +33,11 @@ export function ArrivalsPage() {
 
   const load = useCallback(async () => {
     try {
+      const activeProject = isPM ? user?.project_id || undefined : undefined;
       const [arr, whs] = await Promise.all([
-        apiV26.pm.onTheWay(),
-        apiV26.warehouses.list(isPM ? user?.project_id || undefined : undefined),
+        // پروژه‌ی فعال صریحاً ارسال می‌شود؛ بک‌اند تخصیص PM را بررسی می‌کند
+        apiV26.pm.onTheWay(activeProject),
+        apiV26.warehouses.list(activeProject),
       ]);
       setItems(arr);
       setWarehouses(whs);
@@ -186,7 +188,7 @@ export function ArrivalsPage() {
           item_decision_id: it.item_decision_id,
           received_qty: draftReceivedOf(it),
           allocations,
-        });
+        }, isPM ? user?.project_id || undefined : undefined);
       }
       toast.success("رسید (کامل یا جزیی) ثبت شد و به انبارها وارد شد ✓ — اقلام باقی‌مانده همچنان در راه هستند");
       // همگام‌سازی با دفتر تدارکات: store پیشنهادها را تازه کن تا کارت‌های

frontend/src/pages/Inventory/ChangeInventoryPage.tsx

@@ -14,11 +14,11 @@ import { uniqueUnits } from "../../lib/units";
 import type { InventoryTransaction, TransactionType } from "../../lib/types";
 import { faNum } from "../../lib/formatters";
 import { gregorianToJalali, MONTHS, toFa } from "../../lib/jalali";
+import { cn } from "../../lib/utils";
 
 type FormType = TransactionType | "TRANSFER";
 
 const FORM_TYPES: { t: FormType; label: string; dir: string; cls: "in" | "out" | "mv" | "cnt"; color: string; desc: string }[] = [
-  // رنگ‌بندی معنایی: سبز زمردی = ورود، رز = خروج، آبی = خنثی/جابه‌جایی/شمارش
   { t: "PURCHASE", label: "موجودی اولیه", dir: "افزایش", cls: "in", color: "#10b981", desc: "ثبت موجودی اولیه — متریال/برند/واحد را از فهرست انتخاب کنید؛ اگر نامی در فهرست نبود، همان نام تایپ‌شده هنگام ثبت به‌صورت خودکار در کاتالوگ سراسری ساخته می‌شود. ثبت حداقل یک مشخصه فنی الزامی است." },
   { t: "WITHDRAWAL", label: "برداشت", dir: "کاهش", cls: "out", color: "#e11d48", desc: "انبار را انتخاب و نام متریال را تایپ کنید؛ همه مدل‌ها (برند و مشخصه متفاوت) نمایش داده می‌شوند. برداشت‌ها در «کنترل روزانه» امروز دیده می‌شوند." },
   { t: "RETURN", label: "برگشت", dir: "افزایش", cls: "in", color: "#10b981", desc: "برگشت از مصالحی که امروز برداشت شده‌اند — نام متریال را تایپ کنید و مقدار برگشتی هر ردیف را بزنید." },
@@ -46,7 +46,6 @@ function jalDateLabel(d: Date): string {
   return `${toFa(jd)} ${MONTHS[jm - 1]} ${toFa(jy)}`;
 }
 
-// تغییر موجودی — پورت کامل صفحه‌ی ارسالی (همه انواع تراکنش)
 export function ChangeInventoryPage() {
   const user = useAuthStore((s) => s.user);
   const data = useInventoryData();
@@ -60,15 +59,12 @@ export function ChangeInventoryPage() {
   const [brandTxt, setBrandTxt] = useState("");
   const [unitTxt, setUnitTxt] = useState("");
   const [qty, setQty] = useState("");
-  // تاریخ و ساعت به صورت ISO (تقویم شمسی — JalaliDatePicker)
   const [dateInput, setDateInput] = useState<string>(() => new Date().toISOString());
-  // مشخصه‌های فنی — چیپ‌های چندتایی، دقیقاً مثل فیلد «مشخصه» در ویزارد دفتر تدارکات
   const [specsChips, setSpecsChips] = useState<string[]>([]);
   const [note, setNote] = useState("");
   const [rows, setRows] = useState<RowDraft[]>([]);
   const [busy, setBusy] = useState(false);
 
-  // prefill از URL (پرش از کنترل روزانه)
   useEffect(() => {
     const t = params.get("type");
     const w = params.get("wh");
@@ -91,7 +87,6 @@ export function ChangeInventoryPage() {
 
   const formRecords = useMemo(() => {
     const txt = matTxt.trim();
-    // انتقال از انبار مبدأ استفاده می‌کند، بقیه از انبار انتخابی
     const wid = type === "TRANSFER" ? fromId : whId;
     return data.inventory.filter((r) => {
       if (r.warehouse?.id !== wid) return false;
@@ -105,8 +100,6 @@ export function ChangeInventoryPage() {
   const unitIdByName = (name: string) => data.lookup.units.find((u) => (u.name_fa || u.code) === name)?.id || null;
   const parseNum = (s: string) => { const v = parseFloat(String(s).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))).replace(/[،,]/g, "")); return isFinite(v) ? v : NaN; };
 
-  // تبدیل امن تاریخ فرم به ISO — اگر فیلد خالی/نامعتبر بود (که قبلاً submit را
-  // بی‌صدا می‌شکست) به «هم‌اکنون» برمی‌گردد تا ثبت هیچ‌وقت قفل نشود.
   const toServerIso = () => {
     try {
       const d = new Date(dateInput);
@@ -115,8 +108,6 @@ export function ChangeInventoryPage() {
     return new Date().toISOString();
   };
 
-  // هر چیپ یک مشخصه است؛ در specs انبار به‌صورت کلید با مقدار خالی ذخیره می‌شود
-  // تا رکوردهای انبارِ دارای مشخصه‌های متفاوت از هم جدا بمانند
   const specsFromChips = () => {
     const out: Record<string, string> = {};
     specsChips.forEach((c) => {
@@ -151,9 +142,6 @@ export function ChangeInventoryPage() {
       .sort((a, b) => new Date(a.transaction_date).getTime() - new Date(b.transaction_date).getTime());
   }, [data.transactions, whId, matTxt]);
 
-  // --- پیدا شده: مانده‌ی مفقودی هر ردیف = مفقودی − مجموع پیداشده‌های قبلیِ همان رکورد
-  const lossKey = (t: InventoryTransaction) =>
-    [t.warehouse_id, t.material?.id || "", t.brand?.id || "", JSON.stringify(t.specs || {})].join("|");
   const foundRemaining = useMemo(() => {
     const foundByKey = new Map<string, number>();
     data.transactions
@@ -170,7 +158,9 @@ export function ChangeInventoryPage() {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [lossTxs, data.transactions, whId, matTxt]);
 
-  // مفقودی‌های کاملاً پیداشده از فهرست «در انتظار پیدا شدن» حذف می‌شوند
+  const lossKey = (t: InventoryTransaction) =>
+    [t.warehouse_id, t.material?.id || "", t.brand?.id || "", JSON.stringify(t.specs || {})].join("|");
+
   const pendingLosses = useMemo(
     () =>
       lossTxs
@@ -188,7 +178,6 @@ export function ChangeInventoryPage() {
     try {
       for (const op of ops) await postOne(op);
       toast.success("ثبت شد ✓");
-      // اعلام به تب‌های دیگر (داشبورد/کنترل روزانه/... باز خودشان را تازه می‌کنند)
       notifyDataChanged("inventory");
       setRows([]);
       setMatTxt("");
@@ -205,7 +194,6 @@ export function ChangeInventoryPage() {
     }
   };
 
-  // ---------- submit handlers ----------
   const submitPurchase = async () => {
     const matName = matTxt.trim();
     const brandName = brandTxt.trim();
@@ -216,10 +204,9 @@ export function ChangeInventoryPage() {
     if (!brandName) return toast.error("نام برند را وارد کنید");
     if (!unitName) return toast.error("نام واحد را وارد کنید");
     if (!(n > 0)) return toast.error("تعداد باید بزرگ‌تر از صفر باشد");
-    if (!specsComplete) return toast.error("حداقل یک مشخصه فنی ثبت کنید (نام را بنویسید و Enter بزنید)");
+    if (!specsComplete) return toast.error("حداقل یک مشخصه فنی ثبت کنید");
 
     try {
-      // ساختِ به‌هنگام موجودیت‌های ناشناخته در کاتالوگ سراسری (بدون پیش‌نیاز تدارکات)
       let uid = unitIdByName(unitName);
       if (!uid) {
         const created = await apiV26.catalog.createUnit(unitName);
@@ -264,7 +251,6 @@ export function ChangeInventoryPage() {
     await postSeq(ops);
   };
 
-  // ---------- شمارش موجودی: پیش‌نمایش اختلاف + تأیید قبل از ثبت ----------
   interface CountConfirmRow {
     material: string;
     unit: string;
@@ -358,7 +344,7 @@ export function ChangeInventoryPage() {
         if (!(n > 0)) return null;
         const item = pendingLosses[i];
         if (!item) return null;
-        if (n > item.remaining) return null; // سقف سمت کلاینت (بک‌اند هم رد می‌کند)
+        if (n > item.remaining) return null;
         const t = item.tx;
         return { transaction_type: "FOUND", warehouse_id: whId, material_id: t.material?.id, brand_id: t.brand?.id || null, quantity: n, unit_id: t.unit?.id ?? null, specs: t.specs || {}, note: r.note, transaction_date: toServerIso() };
       })
@@ -382,12 +368,10 @@ export function ChangeInventoryPage() {
 
   const canSubmit = (): boolean => {
     if (type === "PURCHASE") {
-      // نام‌های تایپ‌شده لازم نیست از قبل در فهرست باشند — در submit ساخته می‌شوند
       return !!(whId && matTxt.trim() && brandTxt.trim() && unitTxt.trim() && parseNum(qty) > 0 && specsComplete);
     }
     if (type === "TRANSFER") return !!(fromId && toId && matTxt.trim() && rows.some((r) => parseNum(r.qty) > 0));
     if (type === "RETURN") return !!(whId && matTxt.trim() && rows.some((r) => parseNum(r.qty) > 0));
-    // پیدا شده: هر مقدار واردشده باید داخل مانده‌ی مفقودی همان ردیف باشد
     if (type === "FOUND") {
       return !!(
         whId &&
@@ -402,7 +386,6 @@ export function ChangeInventoryPage() {
     return !!(whId && matTxt.trim() && rows.some((r) => parseNum(r.qty) > 0));
   };
 
-  // sync rows when the record list changes
   useEffect(() => {
     if (type === "RETURN") {
       setRows(todayWithdrawals.map((t) => ({ key: t.inventory_id, qty: "", note: "" })));
@@ -447,54 +430,68 @@ export function ChangeInventoryPage() {
   const isTransfer = type === "TRANSFER";
 
   return (
-    <div className="min-h-screen">
+    <div className="min-h-screen overflow-x-hidden pb-20">
       <Header
         title="تغییر موجودی"
         sub={inventorySubheader(user)}
         backTo="/inventory"
         backLabel="بازگشت به داشبورد"
       />
-      <PageLayout className="flex flex-col gap-3">
-        {/* انتخاب نوع تراکنش */}
-        <div className="rounded-xl border border-line bg-panel p-3">
+      <PageLayout className="flex flex-col gap-3 px-3 md:px-6 w-full max-w-full">
+        {/* انتخاب نوع تغییر موجودی — چیپ‌های لمسی مرتب در موبایل */}
+        <div className="rounded-xl border border-line bg-panel p-3 w-full shadow-2xs">
           <h3 className="mb-2 text-[13px] font-bold">نوع تغییر موجودی</h3>
-          <div className="flex flex-wrap gap-1.5">
+          <div className="grid grid-cols-2 gap-1.5 sm:flex sm:flex-wrap">
             {FORM_TYPES.map((f) => (
               <button
                 key={f.t}
                 type="button"
                 onClick={() => { setType(f.t); setRows([]); setMatTxt(""); setWhId(""); setFromId(""); setToId(""); }}
-                className={`rounded-lg border px-3 py-2 text-[12.5px] ${type === f.t ? "font-bold text-white" : "border-line bg-panel"}`}
+                className={cn(
+                  "rounded-lg border px-3 py-2 text-xs sm:text-[12.5px] text-start sm:text-center transition-all",
+                  type === f.t ? "font-bold text-white shadow-xs" : "border-line bg-panel text-ink hover:bg-bg"
+                )}
                 style={type === f.t ? { background: f.color, borderColor: f.color } : undefined}
               >
-                {f.label} <span className="text-[10.5px] opacity-80">({f.dir})</span>
+                <div>{f.label}</div>
+                <span className="text-[10px] opacity-80">({f.dir})</span>
               </button>
             ))}
           </div>
-          <p className="mt-2 text-[11.5px] leading-5 text-muted">{meta.desc}</p>
+          <p className="mt-2.5 text-[11.5px] leading-5 text-muted">{meta.desc}</p>
         </div>
 
-        <div className="rounded-xl border border-line bg-panel p-4">
-          {/* انتخاب انبارها */}
+        <div className="rounded-xl border border-line bg-panel p-3 sm:p-4 w-full shadow-2xs">
+          {/* انتخاب انبارها (چیپ‌های لمسی به جای سلکت خام) */}
           {!isTransfer ? (
-            <div className="mb-3 grid gap-3 md:grid-cols-2">
-              <div className="field">
-                <label>انبار *</label>
-                <select
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={whId}
-                  onChange={(e) => { setWhId(e.target.value); setMatTxt(""); setRows([]); }}
-                >
-                  <option value="">— انتخاب کنید —</option>
-                  {whOpts.map((w) => <option key={w.id} value={w.id}>{w.name}</option>)}
-                </select>
+            <div className="mb-3 flex flex-col gap-3">
+              <div className="flex flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">انبار *</label>
+                <div className="flex flex-wrap gap-1.5">
+                  {whOpts.map((w) => (
+                    <button
+                      key={w.id}
+                      type="button"
+                      onClick={() => { setWhId(w.id); setMatTxt(""); setRows([]); }}
+                      className={cn(
+                        "rounded-lg px-3 py-1.5 text-xs font-medium transition-colors",
+                        whId === w.id
+                          ? "bg-accent text-white font-bold shadow-xs"
+                          : "border border-line bg-bg/50 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {w.name}
+                    </button>
+                  ))}
+                </div>
               </div>
+
               {(type === "WITHDRAWAL" || type === "DAMAGE" || type === "WASTE" || type === "LOSS" || type === "STOCK_COUNT" || type === "RETURN" || type === "FOUND") && (
                 <div className="field">
-                  <label>{type === "FOUND" ? "متریال (خالی = همه مفقودی‌ها)" : "متریال *"}</label>
+                  <label className="text-xs font-semibold text-muted">{type === "FOUND" ? "متریال (خالی = همه مفقودی‌ها)" : "متریال *"}</label>
                   <input
                     list="dl-mat"
-                    className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
+                    className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-xs sm:text-sm"
                     placeholder={type === "RETURN" ? "نام متریال برداشت‌شده امروز…" : "نام متریال — از پیشنهادها یا جدید…"}
                     value={matTxt}
                     onChange={(e) => { setMatTxt(e.target.value); setRows([]); }}
@@ -508,33 +505,51 @@ export function ChangeInventoryPage() {
           ) : (
             <div className="mb-3 grid gap-3 md:grid-cols-2">
               <div className="field">
-                <label>از (انبار مبدأ) *</label>
-                <select
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={fromId}
-                  onChange={(e) => { setFromId(e.target.value); setToId(""); setMatTxt(""); setRows([]); }}
-                >
-                  <option value="">— انتخاب انبار مبدأ —</option>
-                  {whOpts.map((w) => <option key={w.id} value={w.id}>{w.name}</option>)}
-                </select>
+                <label className="text-xs font-semibold text-muted">از (انبار مبدأ) *</label>
+                <div className="flex flex-wrap gap-1.5 mt-1">
+                  {whOpts.map((w) => (
+                    <button
+                      key={w.id}
+                      type="button"
+                      onClick={() => { setFromId(w.id); setToId(""); setMatTxt(""); setRows([]); }}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-xs font-medium transition-colors",
+                        fromId === w.id
+                          ? "bg-accent text-white font-bold shadow-xs"
+                          : "border border-line bg-bg/50 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {w.name}
+                    </button>
+                  ))}
+                </div>
               </div>
               <div className="field">
-                <label>به (انبار مقصد) *</label>
-                <select
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={toId}
-                  disabled={!fromId}
-                  onChange={(e) => { setToId(e.target.value); setMatTxt(""); setRows([]); }}
-                >
-                  <option value="">— انتخاب انبار مقصد —</option>
-                  {whOpts.filter((w) => w.id !== fromId).map((w) => <option key={w.id} value={w.id}>{w.name}</option>)}
-                </select>
+                <label className="text-xs font-semibold text-muted">به (انبار مقصد) *</label>
+                <div className="flex flex-wrap gap-1.5 mt-1">
+                  {whOpts.filter((w) => w.id !== fromId).map((w) => (
+                    <button
+                      key={w.id}
+                      type="button"
+                      disabled={!fromId}
+                      onClick={() => { setToId(w.id); setMatTxt(""); setRows([]); }}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-xs font-medium transition-colors disabled:opacity-40",
+                        toId === w.id
+                          ? "bg-accent text-white font-bold shadow-xs"
+                          : "border border-line bg-bg/50 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {w.name}
+                    </button>
+                  ))}
+                </div>
               </div>
               <div className="field md:col-span-2">
-                <label>متریال *</label>
+                <label className="text-xs font-semibold text-muted">متریال *</label>
                 <input
                   list="dl-mat2"
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
+                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-xs sm:text-sm"
                   placeholder="نام متریال را تایپ کنید — همه مدل‌ها نمایش داده می‌شوند…"
                   value={matTxt}
                   onChange={(e) => { setMatTxt(e.target.value); setRows([]); }}
@@ -550,7 +565,7 @@ export function ChangeInventoryPage() {
           {type === "PURCHASE" && (
             <div className="grid gap-3 md:grid-cols-2">
               <div className="field md:col-span-2">
-                <label>متریال *</label>
+                <label className="text-xs font-semibold text-muted">متریال *</label>
                 <Combobox
                   value={matTxt}
                   items={data.lookup.materials.map((mm) => mm.name)}
@@ -567,7 +582,7 @@ export function ChangeInventoryPage() {
                 )}
               </div>
               <div className="field">
-                <label>برند *</label>
+                <label className="text-xs font-semibold text-muted">برند *</label>
                 <Combobox
                   value={brandTxt}
                   items={data.lookup.brands.map((b) => b.name)}
@@ -579,7 +594,7 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field">
-                <label>واحد *</label>
+                <label className="text-xs font-semibold text-muted">واحد *</label>
                 <Combobox
                   value={unitTxt}
                   items={uniqueUnits(data.lookup.units).map((u) => u.name_fa || u.code)}
@@ -591,17 +606,17 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field">
-                <label>تعداد *</label>
+                <label className="text-xs font-semibold text-muted">تعداد *</label>
                 <input
                   inputMode="decimal"
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm ltr"
+                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-xs sm:text-sm ltr"
                   placeholder="مثلاً ۲۰۰"
                   value={qty}
                   onChange={(e) => setQty(e.target.value)}
                 />
               </div>
               <div className="field">
-                <label>تاریخ و زمان (شمسی)</label>
+                <label className="text-xs font-semibold text-muted">تاریخ و زمان (شمسی)</label>
                 <JalaliDatePicker
                   value={dateInput}
                   onChange={(iso) => setDateInput(iso ?? new Date().toISOString())}
@@ -610,7 +625,7 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field md:col-span-2">
-                <label>مشخصه‌های فنی *</label>
+                <label className="text-xs font-semibold text-muted">مشخصه‌های فنی *</label>
                 <MultiSelectCombobox
                   values={specsChips}
                   onChange={setSpecsChips}
@@ -619,9 +634,9 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field md:col-span-2">
-                <label>یادداشت</label>
+                <label className="text-xs font-semibold text-muted">یادداشت</label>
                 <textarea
-                  className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-sm"
+                  className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-xs sm:text-sm"
                   placeholder="شماره فاکتور، تأمین‌کننده، توضیحات…"
                   value={note}
                   onChange={(e) => setNote(e.target.value)}
@@ -647,12 +662,10 @@ export function ChangeInventoryPage() {
             />
           )}
 
-          {/* برگشت — برداشت‌های امروز */}
           {type === "RETURN" && (
             <ReturnTable rows={rows} setRows={setRows} txs={todayWithdrawals} whId={whId} matTxt={matTxt} unitNameFn={(id) => unitName(data.lookup.units, id)} />
           )}
 
-          {/* انتقال */}
           {type === "TRANSFER" && (
             <RowTable
               isCount={false}
@@ -669,7 +682,6 @@ export function ChangeInventoryPage() {
             />
           )}
 
-          {/* پیدا شده — مفقودی‌ها (با سقف: پیدا شده ≤ مانده‌ی مفقودی) */}
           {type === "FOUND" && (
             <FoundTable
               rows={rows}
@@ -681,13 +693,13 @@ export function ChangeInventoryPage() {
           )}
 
           {/* دکمه ثبت */}
-          <div className="mt-4 flex items-center justify-between border-t border-line pt-3">
-            <span className="text-[12px] text-muted">👤 ثبت با نام: <b>{user?.display_name}</b></span>
+          <div className="mt-4 flex flex-col-reverse sm:flex-row items-center justify-between gap-3 border-t border-line pt-3">
+            <span className="text-[11.5px] text-muted">👤 ثبت با نام: <b>{user?.display_name}</b></span>
             <button
               type="button"
               disabled={!canSubmit() || busy}
               onClick={doSubmit}
-              className="rounded-lg px-5 py-2 text-[13px] font-bold text-white disabled:opacity-40"
+              className="w-full sm:w-auto rounded-lg px-5 py-2.5 text-xs sm:text-[13px] font-bold text-white disabled:opacity-40 shadow-xs transition-transform active:scale-95"
               style={{ background: meta.color }}
             >
               ✓ {busy ? "در حال ثبت…" : meta.label === "انتقال" ? "ثبت انتقال" : meta.label === "برگشت" ? "ثبت برگشت" : meta.label === "پیدا شده" ? "ثبت پیدا شدن" : `ثبت ${meta.label}`}
@@ -695,10 +707,10 @@ export function ChangeInventoryPage() {
           </div>
         </div>
 
-        {/* مودال تأیید شمارش موجودی (اختلاف قبل از ثبت) */}
+        {/* مودال تأیید شمارش موجودی */}
         {countConfirm && (
           <div className="fixed inset-0 z-50 flex items-center justify-center bg-ink/40 p-4" onClick={() => !countBusy && setCountConfirm(null)}>
-            <div className="w-full max-w-lg rounded-xl border border-line bg-panel p-5 shadow-xl" onClick={(e) => e.stopPropagation()}>
+            <div className="w-full max-w-lg rounded-xl border border-line bg-panel p-4 sm:p-5 shadow-xl" onClick={(e) => e.stopPropagation()}>
               <h3 className="mb-1 text-[14px] font-bold">🔍 تأیید شمارش موجودی</h3>
               <p className="mb-3 text-[11.5px] leading-5 text-muted">
                 موجودی هر ردیف به «تعداد شمارش‌شده» اصلاح می‌شود و اختلاف (کسری/مازاد) ثبت خواهد شد.
@@ -767,7 +779,6 @@ export function ChangeInventoryPage() {
 }
 
 function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
-
   isCount: boolean;
   rows: RowDraft[];
   setRows: (r: RowDraft[]) => void;
@@ -778,7 +789,7 @@ function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
   if (emptyMsg) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">{emptyMsg}</div>;
   return (
     <div className="overflow-x-auto">
-      <table className="w-full text-[12.5px]">
+      <table className="w-full text-[12.5px] min-w-[500px]">
         <thead>
           <tr className="border-b border-line text-right text-muted">
             <th className="py-2 pe-3">مشخصه‌ها</th>
@@ -792,22 +803,22 @@ function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
         <tbody>
           {records.map((r, i) => (
             <tr key={r.id} className="border-b border-line/50">
-              <td className="py-1.5 pe-3 text-muted">{Object.entries(r.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
-              <td className="py-1.5 pe-3">{r.brand?.name || "—"}</td>
-              <td className="py-1.5 pe-3">{unitNameFn(r.unit?.id)}</td>
-              <td className="py-1.5 pe-3 font-bold">{faNum(r.quantity_number)}</td>
-              <td className="py-1.5 pe-3">
+              <td className="py-2 pe-3 text-muted">{Object.entries(r.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
+              <td className="py-2 pe-3">{r.brand?.name || "—"}</td>
+              <td className="py-2 pe-3">{unitNameFn(r.unit?.id)}</td>
+              <td className="py-2 pe-3 font-bold">{faNum(r.quantity_number)}</td>
+              <td className="py-2 pe-3">
                 <input
                   inputMode="decimal"
-                  className="h-7 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
+                  className="h-8 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
                   placeholder={isCount ? "شمارش‌شده" : "۰"}
                   value={isCount && rows[i]?.qty === "" ? String(r.quantity_number) : (rows[i]?.qty || "")}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, qty: e.target.value } : x)))}
                 />
               </td>
-              <td className="py-1.5">
+              <td className="py-2">
                 <input
-                  className="h-7 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
+                  className="h-8 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
                   placeholder="توضیح (اختیاری)"
                   value={rows[i]?.note || ""}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, note: e.target.value } : x)))}
@@ -817,7 +828,7 @@ function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
           ))}
         </tbody>
       </table>
-      <div className="mt-1 text-[11.5px] text-muted">ستون «موجودی فعلی» مقدار موجود هر رکورد است. برای هر ردیف تعداد و یادداشت (در صورت نیاز) وارد کنید.</div>
+      <div className="mt-2 text-[11px] text-muted">ستون «موجودی فعلی» مقدار موجود هر رکورد است. برای هر ردیف تعداد و یادداشت وارد کنید.</div>
     </div>
   );
 }
@@ -831,10 +842,10 @@ function ReturnTable({ rows, setRows, txs, whId, matTxt, unitNameFn }: {
   unitNameFn: (id: number | null | undefined) => string;
 }) {
   if (!whId || !matTxt.trim()) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">برای مشاهده برداشت‌های امروز، انبار و نام متریال را وارد کنید.</div>;
-  if (!txs.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">امروز برداشتی برای این متریال در انبار انتخابی ثبت نشده است — چیزی برای برگشت وجود ندارد.</div>;
+  if (!txs.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">امروز برداشتی برای این متریال در انبار انتخابی ثبت نشده است.</div>;
   return (
     <div className="overflow-x-auto">
-      <table className="w-full text-[12.5px]">
+      <table className="w-full text-[12.5px] min-w-[500px]">
         <thead>
           <tr className="border-b border-line text-right text-muted">
             <th className="py-2 pe-3">مشخصه‌ها</th>
@@ -848,22 +859,22 @@ function ReturnTable({ rows, setRows, txs, whId, matTxt, unitNameFn }: {
         <tbody>
           {txs.map((t, i) => (
             <tr key={t.inventory_id + i} className="border-b border-line/50">
-              <td className="py-1.5 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
-              <td className="py-1.5 pe-3">{t.brand?.name || "—"}</td>
-              <td className="py-1.5 pe-3">{unitNameFn(t.unit?.id)}</td>
-              <td className="py-1.5 pe-3 font-bold">{faNum(Math.abs(t.quantity_number || 0))}</td>
-              <td className="py-1.5 pe-3">
+              <td className="py-2 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
+              <td className="py-2 pe-3">{t.brand?.name || "—"}</td>
+              <td className="py-2 pe-3">{unitNameFn(t.unit?.id)}</td>
+              <td className="py-2 pe-3 font-bold">{faNum(Math.abs(t.quantity_number || 0))}</td>
+              <td className="py-2 pe-3">
                 <input
                   inputMode="decimal"
-                  className="h-7 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
+                  className="h-8 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
                   placeholder="۰"
                   value={rows[i]?.qty || ""}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, qty: e.target.value } : x)))}
                 />
               </td>
-              <td className="py-1.5">
+              <td className="py-2">
                 <input
-                  className="h-7 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
+                  className="h-8 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
                   placeholder="توضیح برگشت"
                   value={rows[i]?.note || ""}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, note: e.target.value } : x)))}
@@ -885,17 +896,17 @@ function FoundTable({ rows, setRows, items, whId, unitNameFn }: {
   unitNameFn: (id: number | null | undefined) => string;
 }) {
   if (!whId) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">ابتدا انبار را انتخاب کنید.</div>;
-  if (!items.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">مفقودی ثبت‌نشده‌ای (یا کاملاً پیداشده) در این انبار وجود ندارد.</div>;
+  if (!items.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">مفقودی ثبت‌نشده‌ای در این انبار وجود ندارد.</div>;
   return (
     <div className="overflow-x-auto">
-      <table className="w-full text-[12.5px]">
+      <table className="w-full text-[12.5px] min-w-[550px]">
         <thead>
           <tr className="border-b border-line text-right text-muted">
             <th className="py-2 pe-3">متریال</th>
             <th className="py-2 pe-3">مشخصه‌ها</th>
             <th className="py-2 pe-3">برند</th>
             <th className="py-2 pe-3">واحد</th>
-            <th className="py-2 pe-3">مانده‌ی مفقودی</th>
+            <th className="py-2 pe-3">مانده مفقودی</th>
             <th className="py-2 pe-3">تعداد پیداشده</th>
             <th className="py-2">یادداشت</th>
           </tr>
@@ -906,28 +917,26 @@ function FoundTable({ rows, setRows, items, whId, unitNameFn }: {
             const over = entered > remaining;
             return (
               <tr key={t.inventory_id + i} className={`border-b border-line/50 ${over ? "bg-rose-50/40" : ""}`}>
-                <td className="py-1.5 pe-3 font-semibold">{t.material?.name || "—"}</td>
-                <td className="py-1.5 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
-                <td className="py-1.5 pe-3">{t.brand?.name || "—"}</td>
-                <td className="py-1.5 pe-3">{unitNameFn(t.unit?.id)}</td>
-                <td className="py-1.5 pe-3 font-bold text-rose-600">{faNum(remaining)}</td>
-                <td className="py-1.5 pe-3">
+                <td className="py-2 pe-3 font-semibold">{t.material?.name || "—"}</td>
+                <td className="py-2 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
+                <td className="py-2 pe-3">{t.brand?.name || "—"}</td>
+                <td className="py-2 pe-3">{unitNameFn(t.unit?.id)}</td>
+                <td className="py-2 pe-3 font-bold text-rose-600">{faNum(remaining)}</td>
+                <td className="py-2 pe-3">
                   <input
                     inputMode="decimal"
-                    className={`h-7 w-24 rounded-lg border bg-panel px-2 text-sm ltr ${over ? "border-red-500 bg-rose-50 text-rose-700" : "border-line"}`}
+                    className={`h-8 w-24 rounded-lg border bg-panel px-2 text-sm ltr ${over ? "border-red-500 bg-rose-50 text-rose-700" : "border-line"}`}
                     placeholder="۰"
                     value={rows[i]?.qty || ""}
                     onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, qty: e.target.value } : x)))}
                   />
                   {over && (
-                    <div className="mt-0.5 text-[10.5px] font-bold text-rose-700">
-                      تعداد پیداشده نمی‌تواند بیشتر از مقدار مفقودی باشد.
-                    </div>
+                    <div className="mt-0.5 text-[10px] font-bold text-rose-700">بیشتر از مفقودی!</div>
                   )}
                 </td>
-                <td className="py-1.5">
+                <td className="py-2">
                   <input
-                    className="h-7 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
+                    className="h-8 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
                     placeholder="توضیح"
                     value={rows[i]?.note || ""}
                     onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, note: e.target.value } : x)))}
@@ -942,8 +951,7 @@ function FoundTable({ rows, setRows, items, whId, unitNameFn }: {
   );
 }
 
-// تبدیل اعداد فارسی/اعشاری برای اعتبارسنجی نمایشی (بدون ارسال)
 function parseNumLocal(s: string): number {
   const v = parseFloat(String(s).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))).replace(/[،,]/g, ""));
   return isFinite(v) ? v : 0;
-}
+}

frontend/src/pages/Inventory/DailyControlPage.tsx

@@ -1,5 +1,16 @@
 import { useMemo, useRef, useState } from "react";
-import { useNavigate } from "react-router-dom";
+import { useNavigate, Link } from "react-router-dom";
+import { 
+  ChevronRight, 
+  ChevronLeft, 
+  Calendar as CalendarIcon, 
+  Building2, 
+  Plus, 
+  RotateCcw, 
+  PackageX, 
+  Trash2,
+  Clock
+} from "lucide-react";
 import { Header, PageLayout } from "../../components/layout/Header";
 import { useAuthStore } from "../../store/auth";
 import { inventorySubheader } from "./panelMenu";
@@ -16,9 +27,8 @@ function todayKey(): string {
   return gregKey(new Date());
 }
 
-// کنترل روزانه — پورت کامل تقویم شمسی نسخه‌ی ارسالی
 export function DailyControlPage() {
-    const user = useAuthStore((s) => s.user);
+  const user = useAuthStore((s) => s.user);
   const data = useInventoryData();
   const navigate = useNavigate();
   const isPM = user?.role === "pm";
@@ -26,7 +36,6 @@ export function DailyControlPage() {
   const [anchor, setAnchor] = useState<Date>(new Date());
   const [sel, setSel] = useState<string>(todayKey());
   const [actRec, setActRec] = useState<string | null>(null);
-  // فیلتر پروژه — فقط برای مدیر تدارکات/ادمین (مدیر پروژه به پروژه خودش محدود است)
   const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
   const [projFilter, setProjFilter] = useState("");
 
@@ -46,7 +55,6 @@ export function DailyControlPage() {
     return map;
   }, [data.transactions, data.warehouses, projFilter]);
 
-  // cells: 42 روز از شنبه قبلِ اولین روز ماه جلالی
   const cells = useMemo(() => {
     const [ty, tm] = gregorianToJalali(anchor.getFullYear(), anchor.getMonth() + 1, anchor.getDate());
     let first: Date | null = null;
@@ -59,7 +67,7 @@ export function DailyControlPage() {
       }
     }
     if (!first) first = new Date(anchor.getTime() - 33 * 86400000);
-    const offset = (first.getDay() + 1) % 7; // شنبه = 0
+    const offset = (first.getDay() + 1) % 7;
     const gridStart = new Date(first.getTime() - offset * 86400000);
     const out: { d: Date; inMonth: boolean; isToday: boolean; n: number }[] = [];
     for (let c = 0; c < 42; c++) {
@@ -79,7 +87,6 @@ export function DailyControlPage() {
   const [ty, tm] = gregorianToJalali(anchor.getFullYear(), anchor.getMonth() + 1, anchor.getDate());
   const monthTitle = `${toFa(ty)} ${MONTHS[tm - 1]}`;
 
-  // جابه‌جایی بین ماه‌های شمسی (نه ±۳۳ روز) — ماه قبل/بعد با سال‌شماری درست
   const shiftMonth = (delta: number) => {
     let nm = tm + delta;
     let ny = ty;
@@ -90,18 +97,12 @@ export function DailyControlPage() {
       nm = 1;
       ny += 1;
     }
-    // روزِ برگشتی را نگه می‌داریم (ماه شمسی از میانه‌ی ماه میلادی شروع می‌شود:
-    // مثلاً مهر ۱ = ۲۳ سپتامبر). اگر به‌جای آن روز «۱» استفاده شود، لنگر در
-    // اولِ ماهِ میلادی می‌نشیند و هنوز در همان ماه شمسی است — دکمه «ماه بعد»
-    // ظاهراً هیچ کاری نمی‌کند.
     const [gy, gm, gd] = jalaliToGregorian(ny, nm, 1);
     setAnchor(new Date(gy, gm - 1, gd));
   };
 
   const dayTx = txByDay.get(sel) || [];
 
-  // فعال‌سازی ناوبری ماه از چند مسیر (pointerup / click / کیبورد) با حذف
-  // اجرای تکراری — اگر مرورگر رویداد click را بخورد، pointerup جواب می‌دهد.
   const navLast = useRef<{ key: string; at: number }>({ key: "", at: 0 });
   const navFire = (key: string, action: () => void) => {
     const now = Date.now();
@@ -144,114 +145,219 @@ export function DailyControlPage() {
   const [sy, sm, sd] = gregorianToJalali(selDate.getFullYear(), selDate.getMonth() + 1, selDate.getDate());
 
   return (
-    <div className="min-h-screen">
+    <div className="min-h-screen bg-slate-50/60">
       <Header
         title="کنترل روزانه"
         sub={inventorySubheader(user)}
         backTo="/inventory"
         backLabel="بازگشت به داشبورد"
       />
-      <PageLayout className="flex flex-col gap-3">
-        {isAdmin && (
-          <div className="flex flex-wrap items-center gap-2 rounded-xl border border-line bg-panel px-3 py-2 text-[12.5px]">
-            <label className="font-bold">🏢 پروژه:</label>
-            <select
-              className="h-8 rounded-lg border border-line bg-panel px-2 text-[12.5px]"
-              value={projFilter}
-              onChange={(e) => setProjFilter(e.target.value)}
-            >
-              <option value="">همه پروژه‌ها</option>
-              {data.lookup.projects.map((p) => (
-                <option key={p.id} value={p.id}>{p.name}</option>
-              ))}
-            </select>
-            <span className="text-[11.5px] text-muted">
-              {projFilter
-                ? "نمایش کنترل روزانه فقط برای پروژه انتخابی"
-                : "نمایش کنترل روزانه همه پروژه‌ها"}
+      <PageLayout className="flex flex-col gap-4">
+        {/* نوار پروژه سفید و شفاف */}
+        <div className="flex flex-wrap items-center justify-between gap-3 rounded-xl border border-slate-200 bg-white p-3 shadow-xs">
+          <div className="flex flex-wrap items-center gap-2.5 text-xs">
+            <span className="flex items-center gap-1.5 font-bold text-slate-800">
+              <Building2 className="h-4 w-4 text-blue-600" />
+              <span>پروژه:</span>
+            </span>
+            {isAdmin ? (
+              <select
+                className="h-8 rounded-lg border border-slate-200 bg-white px-2.5 text-xs font-medium text-slate-800 focus:outline-none focus:border-blue-500"
+                value={projFilter}
+                onChange={(e) => setProjFilter(e.target.value)}
+              >
+                <option value="">همه پروژه‌ها</option>
+                {data.lookup.projects.map((p) => (
+                  <option key={p.id} value={p.id}>{p.name}</option>
+                ))}
+              </select>
+            ) : (
+              <span className="font-semibold text-slate-800">پروژه فعال</span>
+            )}
+            <span className="text-[11.5px] text-slate-400">
+              {projFilter ? "نمایش برای پروژه انتخابی" : "نمایش تمام پروژه‌ها"}
             </span>
           </div>
-        )}
-        <div className="grid gap-4 lg:grid-cols-2">
-          {/* تقویم */}
-          <div className="rounded-xl border border-line bg-panel p-4">
-            <div className="mb-2 flex items-center justify-between">
-              <div className="text-[14px] font-bold">📅 {monthTitle}</div>
-              <div className="flex gap-1.5">
-                <button className="cursor-pointer rounded-lg border border-line px-3 py-1 text-[12px] transition-colors hover:bg-slate-100" {...navBtnProps("prev", () => shiftMonth(-1))}>▶ ماه قبل</button>
-                <button className="cursor-pointer rounded-lg border border-line px-3 py-1 text-[12px] transition-colors hover:bg-slate-100" {...navBtnProps("today", () => { setAnchor(new Date()); setSel(todayKey()); setActRec(null); })}>امروز</button>
-                <button className="cursor-pointer rounded-lg border border-line px-3 py-1 text-[12px] transition-colors hover:bg-slate-100" {...navBtnProps("next", () => shiftMonth(1))}>◀ ماه بعد</button>
+
+          <Link
+            to="/inventory/change"
+            className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg bg-blue-600 hover:bg-blue-700 text-white text-xs font-semibold shadow-xs transition-colors no-underline"
+          >
+            <Plus className="h-3.5 w-3.5" />
+            <span>ثبت خروج / تغییر موجودی</span>
+          </Link>
+        </div>
+
+        <div className="grid gap-4 lg:grid-cols-2 items-start">
+          {/* ستون تقویم — سفید، خوانا و بدون هدر تیره */}
+          <div className="rounded-xl border border-slate-200 bg-white p-4 shadow-xs">
+            <div className="mb-4 flex items-center justify-between pb-3 border-b border-slate-100">
+              <div className="flex items-center gap-2 text-[14px] font-bold text-slate-800">
+                <CalendarIcon className="h-4 w-4 text-blue-600" />
+                <span>{monthTitle}</span>
+              </div>
+              <div className="flex items-center gap-1.5">
+                <button
+                  className="inline-flex items-center gap-1 h-7.5 px-2.5 rounded-md border border-slate-200 bg-white text-xs font-medium text-slate-700 hover:border-slate-300 transition-colors cursor-pointer"
+                  {...navBtnProps("prev", () => shiftMonth(-1))}
+                >
+                  <ChevronRight className="h-3.5 w-3.5" />
+                  <span>ماه قبل</span>
+                </button>
+                <button
+                  className="h-7.5 px-3 rounded-md border border-blue-200 bg-blue-50 text-xs font-bold text-blue-700 hover:bg-blue-100 transition-colors cursor-pointer"
+                  {...navBtnProps("today", () => { setAnchor(new Date()); setSel(todayKey()); setActRec(null); })}
+                >
+                  امروز
+                </button>
+                <button
+                  className="inline-flex items-center gap-1 h-7.5 px-2.5 rounded-md border border-slate-200 bg-white text-xs font-medium text-slate-700 hover:border-slate-300 transition-colors cursor-pointer"
+                  {...navBtnProps("next", () => shiftMonth(1))}
+                >
+                  <span>ماه بعد</span>
+                  <ChevronLeft className="h-3.5 w-3.5" />
+                </button>
               </div>
             </div>
-            <div className="grid grid-cols-7 gap-1">
+
+            {/* روزهای هفته */}
+            <div className="grid grid-cols-7 gap-1 text-center">
               {["ش", "ی", "د", "س", "چ", "پ", "ج"].map((d) => (
-                <div key={d} className="py-1 text-center text-[11px] font-bold text-muted">{d}</div>
+                <div key={d} className="py-1 text-xs font-semibold text-slate-400">{d}</div>
               ))}
               {cells.map((c, i) => {
-                // gregorianToJalali → [سال، ماه، روز] — روزِ ماه در خانه‌ی تقویم
                 const [, , jd] = gregorianToJalali(c.d.getFullYear(), c.d.getMonth() + 1, c.d.getDate());
                 const k = gregKey(c.d);
+                const isSelected = sel === k;
+
                 return (
                   <button
                     key={i}
                     type="button"
                     onClick={() => { setSel(k); setActRec(null); }}
-                    className={`relative rounded-lg py-2 text-[12px] ${!c.inMonth ? "text-muted/40" : ""} ${c.isToday ? "bg-accent font-bold text-white" : ""} ${sel === k ? "ring-2 ring-accent" : "hover:bg-accent/5"}`}
+                    className={`relative flex flex-col items-center justify-center h-9 rounded-lg text-xs transition-colors cursor-pointer ${
+                      !c.inMonth ? "text-slate-300" : "text-slate-700 font-medium"
+                    } ${
+                      isSelected
+                        ? "bg-blue-600 text-white font-bold"
+                        : c.isToday
+                        ? "border border-blue-500 font-bold text-blue-600 hover:bg-blue-50/50"
+                        : "hover:bg-slate-100/70"
+                    }`}
                   >
-                    {toFa(jd)}
+                    <span>{toFa(jd)}</span>
+                    {c.n > 0 && (
+                      <span
+                        className={`absolute bottom-1 h-1 w-1 rounded-full ${
+                          isSelected ? "bg-white" : "bg-blue-600"
+                        }`}
+                      />
+                    )}
                   </button>
                 );
               })}
             </div>
           </div>
 
-          {/* برداشت‌های روز */}
-          <div className="rounded-xl border border-line bg-panel p-4">
-            <div className="mb-1 flex items-center justify-between">
-              <h2 className="text-[14px] font-bold">🕘 کنترل روزانه — {isToday ? "امروز " : ""}{toFa(sd)} {MONTHS[sm - 1]} {toFa(sy)}</h2>
-              <span className="rounded-lg bg-rose-50 px-2 py-1 text-[11.5px] font-bold text-rose-600">▼ برداشت‌ها: {faNum(wGroups.length)} قلم</span>
+          {/* ستون جزئیات روز — سفید یکدست */}
+          <div className="rounded-xl border border-slate-200 bg-white p-4 shadow-xs">
+            <div className="mb-2 flex items-center justify-between pb-3 border-b border-slate-100">
+              <div className="flex items-center gap-2">
+                <Clock className="h-4 w-4 text-blue-600" />
+                <h2 className="text-sm font-bold text-slate-800">
+                  {isToday ? "امروز — " : "کنترل — "}
+                  {toFa(sd)} {MONTHS[sm - 1]} {toFa(sy)}
+                </h2>
+              </div>
+              <span
+                className={`rounded-md px-2 py-0.5 text-xs font-semibold ${
+                  wGroups.length > 0
+                    ? "bg-amber-50 text-amber-700 border border-amber-200"
+                    : "text-slate-400 border border-slate-100"
+                }`}
+              >
+                {faNum(wGroups.length)} برداشت
+              </span>
             </div>
-            <p className="mb-3 text-[11.5px] leading-5 text-muted">
-              مواردی که این روز از انبار برداشت و به ساختمان برده شده‌اند. روی هر مورد بزنید و برگشت / مفقودی / اتلاف را انتخاب کنید.
+
+            <p className="mb-3 text-[11.5px] leading-5 text-slate-500">
+              اقلام برداشت‌شده از انبار در این تاریخ:
             </p>
+
             {!wGroups.length ? (
-              <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">
-                {isToday ? "امروز هنوز برداشتی ثبت نشده است." : "در این روز برداشتی ثبت نشده است."} هر برداشتی که در «تغییر موجودی» ثبت کنید، همین‌جا نمایش داده می‌شود.
+              <div className="flex flex-col items-center justify-center rounded-lg border border-dashed border-slate-200 py-10 px-4 text-center">
+                <span className="text-xs text-slate-400 mb-2">
+                  {isToday ? "امروز هنوز هیچ برداشتی ثبت نشده است." : "در این تاریخ برداشتی ثبت نشده است."}
+                </span>
+                <Link
+                  to="/inventory/change"
+                  className="inline-flex items-center gap-1 px-3 py-1 rounded text-blue-600 hover:bg-blue-50 text-xs font-semibold transition-colors no-underline"
+                >
+                  <Plus className="h-3 w-3" />
+                  <span>ثبت برداشت جدید</span>
+                </Link>
               </div>
             ) : (
-              <div className="flex flex-col gap-1.5">
+              <div className="flex flex-col gap-2">
                 {wGroups.map((g) => (
-                  <div key={g.recId} className={`rounded-lg border p-2.5 ${actRec === g.recId ? "border-accent bg-accent/5" : "border-line bg-panel"}`}>
-                    <button type="button" className="flex w-full items-center gap-2 text-start" onClick={() => setActRec(actRec === g.recId ? null : g.recId)}>
-                      <span className="flex h-7 w-7 items-center justify-center rounded-full bg-rose-50 text-rose-600">➖</span>
+                  <div
+                    key={g.recId}
+                    className={`rounded-lg border p-3 transition-colors ${
+                      actRec === g.recId
+                        ? "border-blue-500 bg-blue-50/20"
+                        : "border-slate-100 bg-white hover:border-slate-200"
+                    }`}
+                  >
+                    <button
+                      type="button"
+                      className="flex w-full items-center gap-3 text-start cursor-pointer"
+                      onClick={() => setActRec(actRec === g.recId ? null : g.recId)}
+                    >
                       <span className="min-w-0 flex-1">
-                        <span className="block truncate text-[13px] font-semibold">{g.tx.material?.name || "—"}</span>
-                        <span className="block truncate text-[11px] text-muted">
-                          {[g.tx.brand?.name, Object.entries(g.tx.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · "), whName(data.warehouses, g.tx.warehouse_id)].filter(Boolean).join(" · ")}
+                        <span className="block truncate text-xs font-bold text-slate-800">
+                          {g.tx.material?.name || "—"}
+                        </span>
+                        <span className="block truncate text-[11px] text-slate-400 mt-0.5">
+                          {[
+                            g.tx.brand?.name,
+                            Object.entries(g.tx.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · "),
+                            whName(data.warehouses, g.tx.warehouse_id)
+                          ].filter(Boolean).join(" · ")}
                         </span>
                       </span>
-                      <span className="text-[13px] font-bold text-rose-600">{faNum(g.q)} {unitName(data.lookup.units, g.tx.unit?.id)}</span>
-                      <span className="text-[10.5px] text-muted">{new Date(g.last).toLocaleTimeString("fa-IR", { hour: "2-digit", minute: "2-digit" })}</span>
+                      <span className="text-xs font-bold text-rose-600 tabular-nums">
+                        {faNum(g.q)} {unitName(data.lookup.units, g.tx.unit?.id)}
+                      </span>
+                      <span className="text-[11px] text-slate-400 tabular-nums">
+                        {new Date(g.last).toLocaleTimeString("fa-IR", { hour: "2-digit", minute: "2-digit" })}
+                      </span>
                     </button>
+
                     {actRec === g.recId && isPM && (
-                      <div className="mt-2 flex gap-1.5 border-t border-line pt-2">
+                      <div className="mt-2.5 flex flex-wrap gap-2 border-t border-slate-100 pt-2">
                         <button
-                          className="rounded-lg border border-emerald-300 bg-emerald-50 px-3 py-1 text-[11.5px] font-semibold text-emerald-700"
+                          type="button"
+                          className="inline-flex items-center gap-1 rounded border border-emerald-300 bg-emerald-50 px-2.5 py-1 text-xs font-semibold text-emerald-700 hover:bg-emerald-100 transition-colors cursor-pointer"
                           onClick={() => navigate(`/inventory/change?type=RETURN&wh=${g.tx.warehouse_id}&mat=${encodeURIComponent(g.tx.material?.name || "")}`)}
                         >
-                          ↩️ برگشت
+                          <RotateCcw className="h-3 w-3" />
+                          <span>برگشت</span>
                         </button>
                         <button
-                          className="rounded-lg border border-rose-300 bg-rose-50 px-3 py-1 text-[11.5px] font-semibold text-rose-700"
+                          type="button"
+                          className="inline-flex items-center gap-1 rounded border border-rose-300 bg-rose-50 px-2.5 py-1 text-xs font-semibold text-rose-700 hover:bg-rose-100 transition-colors cursor-pointer"
                           onClick={() => navigate(`/inventory/change?type=LOSS&wh=${g.tx.warehouse_id}&mat=${encodeURIComponent(g.tx.material?.name || "")}`)}
                         >
-                          📦 مفقودی
+                          <PackageX className="h-3 w-3" />
+                          <span>مفقودی</span>
                         </button>
                         <button
-                          className="rounded-lg border border-rose-300 bg-rose-50 px-3 py-1 text-[11.5px] font-semibold text-rose-700"
+                          type="button"
+                          className="inline-flex items-center gap-1 rounded border border-slate-200 bg-white px-2.5 py-1 text-xs font-semibold text-slate-700 hover:bg-slate-50 transition-colors cursor-pointer"
                           onClick={() => navigate(`/inventory/change?type=WASTE&wh=${g.tx.warehouse_id}&mat=${encodeURIComponent(g.tx.material?.name || "")}`)}
                         >
-                          🗑️ اتلاف
+                          <Trash2 className="h-3 w-3" />
+                          <span>اتلاف</span>
                         </button>
                       </div>
                     )}
@@ -264,4 +370,4 @@ export function DailyControlPage() {
       </PageLayout>
     </div>
   );
-}
+}

frontend/src/pages/Inventory/InventoryPage.tsx

@@ -1,9 +1,8 @@
 import { useMemo, useState } from "react";
 import { Link, useLocation, useSearchParams } from "react-router-dom";
-import { Plus, Warehouse as WarehouseIcon } from "lucide-react";
+import { Plus, Warehouse as WarehouseIcon, SlidersHorizontal, ArrowUpDown, X, ChevronDown } from "lucide-react";
 import { Header, PageLayout } from "../../components/layout/Header";
 import { EmptyState } from "../../components/EmptyState";
-import { Badge } from "../../components/ui/badge";
 import { useAuthStore } from "../../store/auth";
 import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
 import { inventorySubheader } from "./panelMenu";
@@ -12,8 +11,9 @@ import { useInventoryData, brandName, catName, materialName, unitName, whName }
 import type { InventoryRow, InventoryTransaction, TransactionType } from "../../lib/types";
 import { faNum } from "../../lib/formatters";
 import { isoToJalaliStr } from "../../lib/jalali";
+import { cn } from "../../lib/utils";
 
-// رنگ‌بندی معنایی: سبز زمردی = ورود/افزایش، رز = خروج/کاهش، آبی = خنثی/جابه‌جایی
+// رنگ‌بندی معنایی تراکنش‌ها
 const TX_META: Record<TransactionType, { label: string; color: string; icon: string }> = {
   PURCHASE: { label: "خرید", color: "#10b981", icon: "🛒" },
   WITHDRAWAL: { label: "برداشت", color: "#e11d48", icon: "➖" },
@@ -47,25 +47,26 @@ function specsHash(specs: Record<string, string> | null | undefined): string {
   return keys.map((k) => `${k}=${s[k]}`).join("|");
 }
 
-// داشبورد انبار — پورت کامل نسخه‌ی ارسالی (گروه‌بندی + خط زمانی + فیلترها)
 export function InventoryPage() {
   const location = useLocation();
   const user = useAuthStore((s) => s.user);
   const { warehouses, inventory, transactions, lookup, loading } = useInventoryData();
-  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager"; // مدیر تدارکات = ادمین دفتر
+  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
   const isPM = user?.role === "pm";
-  // پرش عمیق از «انبارها»: /inventory?warehouse=<id> → داشبورد همان انبار از پیش فیلتر شده
   const [params] = useSearchParams();
 
   const [filters, setFilters] = useState<{ category: string; warehouse: string; material: string; project: string }>({
-    category: "", warehouse: params.get("warehouse") || "", material: "", project: "",
+    category: "",
+    warehouse: params.get("warehouse") || "",
+    material: "",
+    project: "",
   });
   const [sort, setSort] = useState<"asc" | "desc" | "">("");
+  const [showMobileFilters, setShowMobileFilters] = useState(false);
   const [expandedKey, setExpandedKey] = useState<string | null>(null);
   const [selTx, setSelTx] = useState<string | null>(null);
   const [expBrand, setExpBrand] = useState<string | null>(null);
 
-  // ادمین: انبارهای همه پروژه‌ها یا پروژه‌ی انتخابی
   const visibleWarehouses = useMemo(() => {
     if (isAdmin && filters.project) return warehouses.filter((w) => w.project_id === filters.project);
     if (isAdmin) return warehouses;
@@ -86,7 +87,18 @@ export function InventoryPage() {
       const gk = `${whId}|${r.material.id}|${specsHash(r.specs)}`;
       let g = gmap.get(gk);
       if (!g) {
-        g = { key: gk, whId, matId: r.material.id, specs: r.specs || {}, unitId: r.unit?.id ?? null, qty: 0, updatedAt: r.updated_at, recs: [], brands: {}, brandOrder: [] };
+        g = {
+          key: gk,
+          whId,
+          matId: r.material.id,
+          specs: r.specs || {},
+          unitId: r.unit?.id ?? null,
+          qty: 0,
+          updatedAt: r.updated_at,
+          recs: [],
+          brands: {},
+          brandOrder: [],
+        };
         gmap.set(gk, g);
         order.push(gk);
       }
@@ -120,7 +132,7 @@ export function InventoryPage() {
       .slice()
       .sort((a, b) => new Date(a.transaction_date).getTime() - new Date(b.transaction_date).getTime());
 
-  const hasFilter = !!(filters.category || filters.warehouse || filters.material || (isAdmin && filters.project));
+  const hasFilter = !!(filters.category || filters.warehouse || (isAdmin && filters.project));
 
   if (loading) return <div className="min-h-screen" />;
   if (!user || (!isAdmin && !isPM)) {
@@ -135,119 +147,264 @@ export function InventoryPage() {
   }
 
   return (
-    <div className="min-h-screen">
+    <div className="min-h-screen pb-24 md:pb-6 overflow-x-hidden">
       <Header
         title="سامانه مدیریت انبار"
         sub={inventorySubheader(user)}
         icon={<WarehouseIcon className="h-4.5 w-4.5" strokeWidth={2} />}
         menu={<AppSwitcherMenu activeModule="warehouse" canSwitchToProcurement={isAdmin} />}
         actions={
-          <>
+          <div className="hidden md:flex items-center gap-2">
             <InventoryTopNav pathname={location.pathname} variant={isAdmin ? "admin" : "pm"} />
-            {isPM && (
-              <Link
-                to="/inventory/change"
-                className="btn-line-file no-underline bg-accent text-white hover:bg-accent-dark"
-              >
-                <Plus className="h-3.5 w-3.5" />
-                تغییر موجودی
-              </Link>
-            )}
-          </>
+          </div>
         }
       />
-      <PageLayout className="flex flex-col gap-3">
-        {/* فیلترها */}
-        <div className="flex flex-wrap items-end gap-2 rounded-xl border border-line bg-panel p-3">
-          <div className="field">
-            <label>دسته‌بندی</label>
-            <select
-              className="h-8 rounded-lg border border-line bg-panel px-2 text-[12.5px]"
-              value={filters.category}
-              onChange={(e) => setFilters((f) => ({ ...f, category: e.target.value, material: "" }))}
+      <PageLayout className="flex flex-col gap-3 px-3 md:px-6 w-full max-w-full">
+        {/* جعبه فیلترها و جستجو */}
+        <div className="rounded-xl border border-line bg-panel p-2.5 sm:p-3 w-full shadow-2xs">
+          <div className="flex items-center gap-2 w-full">
+            <div className="relative flex-1 min-w-0">
+              <input
+                className="h-9 w-full rounded-lg border border-line bg-bg/50 px-3 text-xs focus:border-accent focus:bg-panel focus:outline-none"
+                placeholder="جستجوی نام متریال…"
+                value={filters.material}
+                onChange={(e) => setFilters((f) => ({ ...f, material: e.target.value }))}
+              />
+              {filters.material && (
+                <button
+                  type="button"
+                  onClick={() => setFilters((f) => ({ ...f, material: "" }))}
+                  className="absolute left-2.5 top-1/2 -translate-y-1/2 text-muted hover:text-ink"
+                >
+                  <X className="h-3.5 w-3.5" />
+                </button>
+              )}
+            </div>
+
+            <button
+              type="button"
+              onClick={() => setShowMobileFilters((s) => !s)}
+              className={cn(
+                "inline-flex shrink-0 h-9 items-center gap-1.5 rounded-lg border px-2.5 text-xs font-medium transition-colors",
+                showMobileFilters || hasFilter
+                  ? "border-accent bg-accent/10 text-accent font-bold"
+                  : "border-line bg-panel text-ink hover:bg-bg"
+              )}
             >
-              <option value="">همه دسته‌بندی‌ها</option>
-              {lookup.categories.map((c) => (
-                <option key={c.id} value={c.id}>{c.name}</option>
-              ))}
-            </select>
+              <SlidersHorizontal className="h-3.5 w-3.5" />
+              <span>فیلترها</span>
+              {hasFilter && <span className="h-1.5 w-1.5 rounded-full bg-accent" />}
+            </button>
+
+            <button
+              type="button"
+              className={cn(
+                "inline-flex shrink-0 h-9 items-center gap-1 rounded-lg border px-2.5 text-xs transition-colors",
+                sort ? "border-accent bg-accent/5 text-accent font-semibold" : "border-line bg-panel text-ink hover:bg-bg"
+              )}
+              onClick={() => setSort((s) => (s === "" ? "asc" : s === "asc" ? "desc" : ""))}
+              title="مرتب‌سازی تعداد"
+            >
+              <ArrowUpDown className="h-3.5 w-3.5" />
+              <span className="hidden sm:inline">
+                {sort === "asc" ? "تعداد: صعودی" : sort === "desc" ? "تعداد: نزولی" : "مرتب‌سازی"}
+              </span>
+            </button>
           </div>
-          {isAdmin && (
-            <div className="field">
-              <label>پروژه</label>
-              <select
-                className="h-8 rounded-lg border border-line bg-panel px-2 text-[12.5px]"
-                value={filters.project}
-                onChange={(e) => setFilters((f) => ({ ...f, project: e.target.value, warehouse: "", material: "" }))}
+
+          {/* فیلتر سریع انبارها (چیپ‌های افقی لمسی) */}
+          {visibleWarehouses.length > 1 && (
+            <div className="mt-2.5 flex items-center gap-1.5 overflow-x-auto pb-1 pt-0.5 [scrollbar-width:none]">
+              <button
+                type="button"
+                onClick={() => setFilters((f) => ({ ...f, warehouse: "" }))}
+                className={cn(
+                  "shrink-0 rounded-lg px-2.5 py-1 text-xs font-medium transition-colors",
+                  !filters.warehouse
+                    ? "bg-accent text-white shadow-xs font-bold"
+                    : "border border-line bg-bg/40 text-muted hover:bg-panel hover:text-ink"
+                )}
               >
-                <option value="">همه پروژه‌ها</option>
-                {lookup.projects.map((p) => (
-                  <option key={p.id} value={p.id}>{p.name}</option>
-                ))}
-              </select>
+                همه انبارها
+              </button>
+              {visibleWarehouses.map((w) => (
+                <button
+                  key={w.id}
+                  type="button"
+                  onClick={() => setFilters((f) => ({ ...f, warehouse: f.warehouse === w.id ? "" : w.id }))}
+                  className={cn(
+                    "shrink-0 rounded-lg px-2.5 py-1 text-xs font-medium transition-colors",
+                    filters.warehouse === w.id
+                      ? "bg-accent text-white shadow-xs font-bold"
+                      : "border border-line bg-bg/40 text-muted hover:bg-panel hover:text-ink"
+                  )}
+                >
+                  {w.name}
+                </button>
+              ))}
             </div>
           )}
-          <div className="field">
-            <label>انبار</label>
-            <select
-              className="h-8 rounded-lg border border-line bg-panel px-2 text-[12.5px]"
-              value={filters.warehouse}
-              onChange={(e) => setFilters((f) => ({ ...f, warehouse: e.target.value, material: "" }))}
-            >
-              <option value="">همه انبارها</option>
-              {visibleWarehouses.map((w) => (
-                <option key={w.id} value={w.id}>
-                  {w.name}{isAdmin ? ` — ${lookup.projects.find((p) => p.id === w.project_id)?.name || ""}` : ""}
-                </option>
-              ))}
-            </select>
-          </div>
-          <div className="field">
-            <label>متریال</label>
-            <input
-              className="h-8 w-44 rounded-lg border border-line bg-panel px-2 text-[12.5px]"
-              placeholder="تایپ نام متریال…"
-              value={filters.material}
-              onChange={(e) => setFilters((f) => ({ ...f, material: e.target.value }))}
-            />
-          </div>
-          <button
-            className="h-8 rounded-lg border border-line bg-panel px-3 text-[12px]"
-            onClick={() => setSort((s) => (s === "" ? "asc" : s === "asc" ? "desc" : ""))}
-          >
-            {sort === "asc" ? "تعداد: صعودی ▲" : sort === "desc" ? "تعداد: نزولی ▼" : "مرتب‌سازی تعداد"}
-          </button>
-          {hasFilter && (
-            <button
-              className="h-8 rounded-lg border border-red/30 bg-red/5 px-3 text-[12px] text-red"
-              onClick={() => setFilters({ category: "", warehouse: "", material: "", project: "" })}
-            >
-              ✕ پاک کردن فیلترها
-            </button>
+
+          {/* فیلترهای پیشرفته — برچسب‌های لمسی بدون سلکت و بدون بیرون‌زدگی */}
+          {showMobileFilters && (
+            <div className="mt-2.5 border-t border-line/60 pt-2.5 flex flex-col gap-2.5">
+              {/* دسته‌بندی‌ها */}
+              <div>
+                <div className="mb-1.5 text-[11px] font-bold text-muted">دسته‌بندی متریال:</div>
+                <div className="flex flex-wrap gap-1.5">
+                  <button
+                    type="button"
+                    onClick={() => setFilters((f) => ({ ...f, category: "" }))}
+                    className={cn(
+                      "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                      !filters.category
+                        ? "bg-accent text-white font-bold"
+                        : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                    )}
+                  >
+                    همه دسته‌بندی‌ها
+                  </button>
+                  {lookup.categories.map((c) => (
+                    <button
+                      key={c.id}
+                      type="button"
+                      onClick={() => setFilters((f) => ({ ...f, category: f.category === c.id ? "" : c.id }))}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                        filters.category === c.id
+                          ? "bg-accent text-white font-bold"
+                          : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {c.name}
+                    </button>
+                  ))}
+                </div>
+              </div>
+
+              {/* پروژه‌ها (مخصوص ادمین) */}
+              {isAdmin && lookup.projects.length > 0 && (
+                <div>
+                  <div className="mb-1.5 text-[11px] font-bold text-muted">پروژه:</div>
+                  <div className="flex flex-wrap gap-1.5">
+                    <button
+                      type="button"
+                      onClick={() => setFilters((f) => ({ ...f, project: "" }))}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                        !filters.project
+                          ? "bg-accent text-white font-bold"
+                          : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                      )}
+                    >
+                      همه پروژه‌ها
+                    </button>
+                    {lookup.projects.map((p) => (
+                      <button
+                        key={p.id}
+                        type="button"
+                        onClick={() => setFilters((f) => ({ ...f, project: f.project === p.id ? "" : p.id }))}
+                        className={cn(
+                          "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                          filters.project === p.id
+                            ? "bg-accent text-white font-bold"
+                            : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                        )}
+                      >
+                        {p.name}
+                      </button>
+                    ))}
+                  </div>
+                </div>
+              )}
+
+              {/* دکمه پاک کردن فیلترها */}
+              {hasFilter && (
+                <div className="pt-1 flex items-center justify-between">
+                  <button
+                    type="button"
+                    className="text-xs text-red font-medium hover:underline inline-flex items-center gap-1"
+                    onClick={() => setFilters({ category: "", warehouse: "", material: "", project: "" })}
+                  >
+                    <X className="h-3 w-3" />
+                    پاک کردن فیلترها
+                  </button>
+                  <span className="text-[11px] text-muted">
+                    نمایش {faNum(groups.length)} قلم کالا
+                  </span>
+                </div>
+              )}
+            </div>
           )}
-          {filters.warehouse && (
-            <Badge variant="offered">🏬 {whName(warehouses, filters.warehouse)}</Badge>
-          )}
-          <Badge variant="outline">{faNum(groups.length)} قلم کالا</Badge>
         </div>
 
-        {/* جدول گروه‌بندی‌شده */}
-        <div className="overflow-hidden rounded-xl border border-line bg-panel">
+        {/* ۱. نمای مخصوص موبایل: کارت‌های عمودی کاملاً ریسپانسیو */}
+        <div className="flex flex-col gap-2.5 md:hidden w-full">
+          {!groups.length ? (
+            <div className="rounded-xl border border-line bg-panel p-4">
+              <EmptyState emoji="📋" text="هیچ رکورد موجودی‌ای مطابق فیلترهای انتخابی یافت نشد." />
+            </div>
+          ) : (
+            groups.map((g) => {
+              const isExp = expandedKey === g.key;
+              const matCat = lookup.materials.find((m) => m.id === g.matId)?.category;
+              return (
+                <InventoryMobileCard
+                  key={g.key}
+                  g={g}
+                  isExp={isExp}
+                  isAdmin={isAdmin}
+                  matName={materialName(lookup.materials, g.matId)}
+                  matCatName={matCat ? catName(lookup.categories, matCat.id) : "—"}
+                  wh={whName(warehouses, g.whId)}
+                  projName={lookup.projects.find((p) => p.id === warehouses.find((w) => w.id === g.whId)?.project_id)?.name || ""}
+                  unit={unitName(lookup.units, g.unitId)}
+                  onToggle={() => {
+                    setExpandedKey(isExp ? null : g.key);
+                    setSelTx(null);
+                    setExpBrand(null);
+                  }}
+                  timeline={
+                    isExp ? (
+                      <Timeline
+                        g={g}
+                        txs={groupTxs(g)}
+                        allTxs={transactions}
+                        brandTxs={brandTxs}
+                        selTx={selTx}
+                        setSelTx={setSelTx}
+                        expBrand={expBrand}
+                        setExpBrand={setExpBrand}
+                        matName={materialName(lookup.materials, g.matId)}
+                        unit={unitName(lookup.units, g.unitId)}
+                        brandNameFn={(id) => brandName(lookup.brands, id)}
+                        whNameFn={(id) => whName(warehouses, id)}
+                      />
+                    ) : null
+                  }
+                />
+              );
+            })
+          )}
+        </div>
+
+        {/* ۲. نمای دسکتاپ: جدول سنتی */}
+        <div className="hidden md:block overflow-x-auto rounded-xl border border-line bg-panel shadow-2xs [scrollbar-width:thin]">
           {!groups.length ? (
             <EmptyState emoji="📋" text="هیچ رکورد موجودی‌ای مطابق فیلترهای انتخابی یافت نشد." />
           ) : (
-            <table className="w-full text-[12.5px]">
+            <table className="w-full min-w-[640px] text-[12.5px]">
               <thead>
-                <tr className="border-b border-line bg-panel text-right text-muted">
-                  <th className="w-8 py-2" />
-                  <th className="py-2 pe-3">متریال</th>
-                  <th className="py-2 pe-3">دسته‌بندی</th>
-                  <th className="py-2 pe-3">انبار</th>
-                  <th className="py-2 pe-3">مشخصه فنی</th>
-                  <th className="py-2 pe-3">تعداد</th>
-                  <th className="py-2 pe-3">واحد</th>
-                  <th className="py-2 pe-3">آخرین به‌روزرسانی</th>
-                  <th className="w-8 py-2" />
+                <tr className="border-b border-line bg-bg/40 text-right text-muted">
+                  <th className="w-8 py-2.5" />
+                  <th className="py-2.5 pe-3 font-semibold">متریال</th>
+                  <th className="py-2.5 pe-3 font-semibold">دسته‌بندی</th>
+                  <th className="py-2.5 pe-3 font-semibold">انبار</th>
+                  <th className="py-2.5 pe-3 font-semibold">مشخصه فنی</th>
+                  <th className="py-2.5 pe-3 font-semibold">تعداد</th>
+                  <th className="py-2.5 pe-3 font-semibold">واحد</th>
+                  <th className="py-2.5 pe-3 font-semibold">آخرین به‌روزرسانی</th>
+                  <th className="w-8 py-2.5" />
                 </tr>
               </thead>
               <tbody>
@@ -295,10 +452,124 @@ export function InventoryPage() {
             </table>
           )}
         </div>
-        <div className="text-[11px] text-muted">
-          ۱۰ نوع تراکنش استاندارد • سبز زمردی = ورود به انبار · رز = خروج/کاهش · آبی = انتقال و شمارش • کلیک روی هر سطر: خط زمانی با «مانده» لحظه‌به‌لحظه و تفکیک برندها
-        </div>
       </PageLayout>
+
+      {/* دکمه شناور تغییر موجودی */}
+      {isPM && (
+        <Link
+          to="/inventory/change"
+          className="fixed bottom-20 left-5 z-40 flex h-14 w-14 items-center justify-center rounded-full bg-blue-600 text-white shadow-xl shadow-blue-600/40 transition-all duration-200 hover:bg-blue-700 hover:scale-105 active:scale-90 md:bottom-8 md:left-8"
+          title="تغییر موجودی"
+          aria-label="تغییر موجودی"
+        >
+          <Plus className="h-7 w-7" strokeWidth={2.5} />
+        </Link>
+      )}
+    </div>
+  );
+}
+
+// کامپوننت کارت انبار در موبایل
+function InventoryMobileCard({
+  g,
+  isExp,
+  isAdmin,
+  matName,
+  matCatName,
+  wh,
+  projName,
+  unit,
+  onToggle,
+  timeline,
+}: {
+  g: Group;
+  isExp: boolean;
+  isAdmin: boolean;
+  matName: string;
+  matCatName: string;
+  wh: string;
+  projName: string;
+  unit: string;
+  onToggle: () => void;
+  timeline: React.ReactNode;
+}) {
+  const specsText = Object.entries(g.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ");
+
+  return (
+    <div
+      className={cn(
+        "overflow-hidden rounded-xl border bg-panel transition-all shadow-2xs w-full",
+        isExp ? "border-accent/60 ring-1 ring-accent/20" : "border-line hover:border-line/80"
+      )}
+    >
+      <div onClick={onToggle} className="cursor-pointer p-3 active:bg-bg/40 transition-colors">
+        <div className="flex items-start justify-between gap-2">
+          <div className="min-w-0 flex-1">
+            <h3 className="text-[13.5px] font-bold leading-snug text-ink break-words">
+              {matName}
+            </h3>
+            {matCatName !== "—" && (
+              <span className="mt-0.5 inline-block text-[11px] text-muted">
+                {matCatName}
+              </span>
+            )}
+          </div>
+          <div
+            className={cn(
+              "flex h-7 w-7 shrink-0 items-center justify-center rounded-lg bg-bg text-muted transition-transform duration-200",
+              isExp && "rotate-180 bg-accent/10 text-accent"
+            )}
+          >
+            <ChevronDown className="h-4 w-4" />
+          </div>
+        </div>
+
+        {/* کادر شاخص موجودی و انبار */}
+        <div className="my-2.5 flex items-center justify-between gap-3 rounded-lg border border-line/60 bg-bg/50 p-2.5">
+          <div className="flex flex-col">
+            <span className="text-[10px] font-semibold text-muted">موجودی انبار</span>
+            <div className="flex items-baseline gap-1 pt-0.5">
+              <span className="text-lg font-black tabular-nums text-ink">
+                {faNum(g.qty)}
+              </span>
+              <span className="text-[11px] font-medium text-muted">{unit}</span>
+            </div>
+          </div>
+
+          <div className="flex flex-col items-end text-end min-w-0">
+            <span className="text-[10px] font-semibold text-muted">محل نگهداری</span>
+            <div className="flex items-center gap-1 text-xs font-bold text-accent truncate pt-0.5">
+              <WarehouseIcon className="h-3.5 w-3.5 shrink-0" />
+              <span className="truncate">{wh}</span>
+            </div>
+            {isAdmin && projName && (
+              <span className="truncate text-[10px] text-muted max-w-[130px]">{projName}</span>
+            )}
+          </div>
+        </div>
+
+        {/* مشخصات فنی و تاریخ */}
+        <div className="flex items-center justify-between gap-2 text-[10.5px] text-muted pt-0.5">
+          <div className="min-w-0 flex-1 truncate">
+            {specsText ? (
+              <span className="rounded bg-bg px-1.5 py-0.5 text-[10px] font-medium text-ink">
+                {specsText}
+              </span>
+            ) : (
+              <span className="text-muted/60">—</span>
+            )}
+          </div>
+          <span className="shrink-0 tabular-nums">
+            {isoToJalaliStr(g.updatedAt)}
+          </span>
+        </div>
+      </div>
+
+      {isExp && (
+        <div className="border-t border-line/70 bg-accent-bg/10 p-3">
+          {timeline}
+        </div>
+      )}
     </div>
   );
 }
@@ -317,25 +588,25 @@ function GroupRow({ g, isExp, isAdmin, matName, matCatName, wh, projName, unit,
 }) {
   return (
     <>
-      <tr className={`border-b border-line/60 cursor-pointer ${isExp ? "bg-accent/5" : "hover:bg-accent/5"}`} onClick={onToggle}>
-        <td className="py-2 text-center text-muted">{isExp ? "▾" : "▸"}</td>
-        <td className="py-2 pe-3 font-semibold">{matName}</td>
-        <td className="py-2 pe-3">{matCatName}</td>
-        <td className="py-2 pe-3">
-          {wh}
-          {isAdmin && <small className="block text-muted">{projName}</small>}
+      <tr className={`border-b border-line/60 cursor-pointer transition-colors ${isExp ? "bg-accent/5" : "hover:bg-accent/5"}`} onClick={onToggle}>
+        <td className="py-2.5 text-center text-muted">{isExp ? "▾" : "▸"}</td>
+        <td className="py-2.5 pe-3 font-bold text-ink">{matName}</td>
+        <td className="py-2.5 pe-3 text-muted">{matCatName}</td>
+        <td className="py-2.5 pe-3">
+          <div>{wh}</div>
+          {isAdmin && <span className="block text-[10.5px] text-muted">{projName}</span>}
         </td>
-        <td className="py-2 pe-3 text-muted">
+        <td className="py-2.5 pe-3 text-muted">
           {Object.entries(g.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}
         </td>
-        <td className="py-2 pe-3 font-bold">{faNum(g.qty)}</td>
-        <td className="py-2 pe-3">{unit}</td>
-        <td className="py-2 pe-3 text-muted">{isoToJalaliStr(g.updatedAt)}</td>
-        <td className="py-2 text-muted">🕘</td>
+        <td className="py-2.5 pe-3 font-extrabold text-ink tabular-nums">{faNum(g.qty)}</td>
+        <td className="py-2.5 pe-3">{unit}</td>
+        <td className="py-2.5 pe-3 text-muted tabular-nums">{isoToJalaliStr(g.updatedAt)}</td>
+        <td className="py-2.5 text-muted">🕘</td>
       </tr>
       {isExp && (
-        <tr className="border-b border-line/40 bg-accent-bg/20">
-          <td colSpan={9} className="p-3">{timeline}</td>
+        <tr className="border-b border-line/40 bg-accent-bg/10">
+          <td colSpan={9} className="p-3.5">{timeline}</td>
         </tr>
       )}
     </>
@@ -367,14 +638,14 @@ function Timeline({ g, txs, allTxs, brandTxs, selTx, setSelTx, expBrand, setExpB
           key={t.id}
           type="button"
           onClick={() => setSelTx(sel ? null : t.id)}
-          className={`flex min-w-[120px] flex-col gap-0.5 rounded-lg border p-2 text-start ${sel ? "border-accent bg-accent/10" : "border-line bg-panel"}`}
+          className={`flex min-w-[120px] flex-col gap-0.5 rounded-lg border p-2 text-start transition-all ${sel ? "border-accent bg-accent/10 shadow-xs" : "border-line bg-panel hover:border-accent/40"}`}
           style={{ borderTop: `3px solid ${meta.color}` }}
         >
           <span className="text-[11px] font-bold" style={{ color: meta.color }}>{meta.icon} {meta.label}</span>
-          <span className="text-[12px] font-bold" style={{ color: meta.color }}>
+          <span className="text-[12px] font-bold tabular-nums" style={{ color: meta.color }}>
             {faNum(Math.abs(t.quantity_number))} {unit}
           </span>
-          <span className="text-[10.5px] text-muted">مانده: <b>{faNum(bal)}</b> {unit}</span>
+          <span className="text-[10.5px] text-muted">مانده: <b className="tabular-nums">{faNum(bal)}</b> {unit}</span>
         </button>
       );
     });
@@ -385,7 +656,7 @@ function Timeline({ g, txs, allTxs, brandTxs, selTx, setSelTx, expBrand, setExpB
   const brandSec = expBrand ? (
     <div className="mt-2">
       <div className="mb-1 text-[12px] font-semibold">جریان برند: {brandNameFn(expBrand)} ({faNum(brandTxs(g, expBrand).length)} تراکنش)</div>
-      <div className="flex gap-1.5 overflow-x-auto">{track(brandTxs(g, expBrand))}</div>
+      <div className="flex gap-1.5 overflow-x-auto pb-1 [scrollbar-width:thin]">{track(brandTxs(g, expBrand))}</div>
     </div>
   ) : null;
 
@@ -395,21 +666,21 @@ function Timeline({ g, txs, allTxs, brandTxs, selTx, setSelTx, expBrand, setExpB
     const meta = TX_META[t.transaction_type] || { label: t.transaction_type, color: "#64748b", icon: "•" };
     const pairTx = t.transfer_pair_id ? allTxs.find((x) => x.transfer_pair_id === t.transfer_pair_id && x.id !== t.id) : null;
     return (
-      <div className="mt-2 rounded-lg border p-2 text-[12px]" style={{ borderTop: `3px solid ${meta.color}` }}>
+      <div className="mt-2 rounded-lg border p-2.5 text-[12px] bg-panel shadow-2xs" style={{ borderTop: `3px solid ${meta.color}` }}>
         <b style={{ color: meta.color }}>{meta.label}</b>
         <div className="mt-1 flex flex-wrap gap-x-4 gap-y-1 text-muted">
-          <span>تاریخ و ساعت: <b>{isoToJalaliStr(t.transaction_date)}</b></span>
+          <span>تاریخ و ساعت: <b className="text-ink">{isoToJalaliStr(t.transaction_date)}</b></span>
           {t.transaction_type === "TRANSFER_OUT" || t.transaction_type === "TRANSFER_IN" ? (
             <>
-              <span>از انبار: <b>{t.transaction_type === "TRANSFER_OUT" ? whNameFn(t.warehouse_id) : whNameFn(pairTx?.warehouse_id)}</b></span>
-              <span>به انبار: <b>{t.transaction_type === "TRANSFER_IN" ? whNameFn(t.warehouse_id) : whNameFn(pairTx?.warehouse_id)}</b></span>
+              <span>از انبار: <b className="text-ink">{t.transaction_type === "TRANSFER_OUT" ? whNameFn(t.warehouse_id) : whNameFn(pairTx?.warehouse_id)}</b></span>
+              <span>به انبار: <b className="text-ink">{t.transaction_type === "TRANSFER_IN" ? whNameFn(t.warehouse_id) : whNameFn(pairTx?.warehouse_id)}</b></span>
             </>
           ) : (
-            <span>انبار: <b>{whNameFn(t.warehouse_id)}</b></span>
+            <span>انبار: <b className="text-ink">{whNameFn(t.warehouse_id)}</b></span>
           )}
-          {t.brand?.name && <span>برند: <b>{t.brand.name}</b></span>}
-          {t.performed_by && <span>انجام‌دهنده: <b>{t.performed_by}</b></span>}
-          {t.note && <span>یادداشت: <b>{t.note}</b></span>}
+          {t.brand?.name && <span>برند: <b className="text-ink">{t.brand.name}</b></span>}
+          {t.performed_by && <span>انجام‌دهنده: <b className="text-ink">{t.performed_by}</b></span>}
+          {t.note && <span>یادداشت: <b className="text-ink">{t.note}</b></span>}
           {t.transaction_type === "STOCK_COUNT" && t.recorded_qty != null && t.physical_qty != null && (
             <span>
               ثبت‌شده: {faNum(t.recorded_qty)} • شمارش‌شده: {faNum(t.physical_qty)} • اختلاف: {faNum(t.physical_qty - t.recorded_qty)}
@@ -422,14 +693,14 @@ function Timeline({ g, txs, allTxs, brandTxs, selTx, setSelTx, expBrand, setExpB
 
   return (
     <div>
-      <div className="mb-1 flex flex-wrap items-center gap-2 text-[12px]">
+      <div className="mb-1.5 flex flex-wrap items-center gap-2 text-[12px]">
         <b>خط زمانی — {matName}</b>
         {Object.entries(g.specs || {}).length > 0 && (
-          <span className="rounded bg-panel px-1.5 py-0.5 text-[10.5px] text-muted">
+          <span className="rounded bg-panel px-2 py-0.5 text-[10.5px] text-muted border border-line">
             {Object.entries(g.specs).map(([k, v]) => `${k}: ${v}`).join(" · ")}
           </span>
         )}
-        <span className="rounded bg-panel px-1.5 py-0.5 text-[10.5px] text-muted">{faNum(g.brandOrder.length)} برند</span>
+        <span className="rounded bg-panel px-2 py-0.5 text-[10.5px] text-muted border border-line">{faNum(g.brandOrder.length)} برند</span>
       </div>
       <div className="mb-2 flex flex-wrap gap-1.5">
         {g.brandOrder.map((bid) => (
@@ -437,16 +708,16 @@ function Timeline({ g, txs, allTxs, brandTxs, selTx, setSelTx, expBrand, setExpB
             key={bid}
             type="button"
             onClick={() => setExpBrand(expBrand === bid ? null : bid)}
-            className={`rounded-lg border px-2 py-1 text-[11.5px] ${expBrand === bid ? "border-accent bg-accent/10 text-accent" : "border-line bg-panel"}`}
+            className={`rounded-lg border px-2 py-1 text-[11.5px] transition-colors ${expBrand === bid ? "border-accent bg-accent/10 text-accent font-bold" : "border-line bg-panel hover:bg-bg"}`}
           >
-            {brandNameFn(bid)}: <b>{faNum(g.brands[bid])}</b> {unit}{expBrand === bid ? " ✕" : ""}
+            {brandNameFn(bid)}: <b className="tabular-nums">{faNum(g.brands[bid])}</b> {unit}{expBrand === bid ? " ✕" : ""}
           </button>
         ))}
       </div>
       {brandSec}
       <div className="mb-1 mt-2 text-[12px] font-semibold">جریان کلی رکورد — ترکیب همه برندها ({faNum(txs.length)} تراکنش)</div>
-      <div className="flex gap-1.5 overflow-x-auto pb-1">{track(txs)}</div>
+      <div className="flex gap-1.5 overflow-x-auto pb-1 [scrollbar-width:thin]">{track(txs)}</div>
       {selDetail}
     </div>
   );
-}
+}

frontend/src/pages/Inventory/InventoryTopNav.tsx

@@ -1,13 +1,7 @@
 import { Link } from "react-router-dom";
-import { cn } from "../../lib/utils";
+import { Button } from "../../components/ui/button";
 
-// ناوبری بالای صفحه در پنل انبار — فقط روی «داشبورد انبار» (هاب) دیده می‌شود؛
-// خودِ «داشبورد انبار» دکمه ندارد (ریشه/هاب است) و زیرصفحه‌ها تب ندارند و
-// فقط با «بازگشت به داشبورد» به هاب برمی‌گردند.
-//
-// - variant="pm" (مدیر پروژه): کنترل روزانه، انبارها، کالاهای در راه —
-//   ورود به «تغییر موجودی» از دکمه‌ی بالای هاب است.
-// - variant="admin" (مدیر تدارکات/ادمین): کنترل روزانه، کالاهای در راه، سازمان‌دهی.
+// ناوبری بالای صفحه در پنل انبار — هماهنگ با دیزاین‌سیستم دکمه‌ها
 export function InventoryTopNav({
   pathname,
   variant = "pm",
@@ -27,20 +21,20 @@ export function InventoryTopNav({
           { label: "انبارها", to: "/inventory/warehouses", active: pathname.startsWith("/inventory/warehouses") },
           { label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") },
         ];
+
   return (
     <>
       {items.map((it) => (
-        <Link
+        <Button
           key={it.to}
-          to={it.to}
-          className={cn(
-            "btn-line-file no-underline",
-            it.active && "border-accent bg-accent text-white hover:bg-accent-dark",
-          )}
+          asChild
+          variant={it.active ? "primary" : "slate"}
         >
-          {it.label}
-        </Link>
+          <Link to={it.to} className="no-underline">
+            {it.label}
+          </Link>
+        </Button>
       ))}
     </>
   );
-}
+}

frontend/src/pages/Inventory/OrganizationPage.tsx

@@ -8,6 +8,7 @@ import { apiV26, type UserRow } from "../../lib/api";
 import { refreshProcurementStore } from "../../hooks";
 import { useInventoryData } from "./useInventoryData";
 import { faNum } from "../../lib/formatters";
+import { ProjectMultiSelect } from "../../components/ProjectMultiSelect";
 
 type Role = "pm" | "procurement_manager" | "admin" | null;
 
@@ -96,17 +97,36 @@ export function OrganizationPage() {
     }
   };
 
-  const changeProject = async (u: UserRow, projectId: string) => {
+  // پروژه‌های متصل به یک کاربر (1:N) — با پشتیبانی از شکل قدیمیِ تک‌پروژه‌ای
+  const assignedProjectsOf = (u: UserRow) =>
+    u.projects ?? (u.project_id ? [{ id: u.project_id, name: u.project_name ?? "" }] : []);
+
+  // همگام‌سازی چند-انتخابیِ پروژه‌ها: افزودن/حذف هر اختلاف با یک PATCH
+  // (pm_user_id = کاربر برای اتصال، null برای جداسازی؛ مدیر قبلی جایگزین می‌شود)
+  const syncUserProjects = async (u: UserRow, nextIds: string[]) => {
+    const current = assignedProjectsOf(u).map((p) => p.id);
+    const added = nextIds.filter((id) => !current.includes(id));
+    const removed = current.filter((id) => !nextIds.includes(id));
+    if (!added.length && !removed.length) return;
     setBusyId(u.id);
     try {
-      const project = data.lookup.projects.find((p) => p.id === projectId);
-      await apiV26.users.assignProject(u.id, projectId || null);
-      toast.success(project ? `«${u.first_name} ${u.last_name}» به پروژه «${project.name}» متصل شد ✓` : "مدیر پروژه از پروژه جدا شد");
+      for (const pid of added) await apiV26.projects.setPm(pid, u.id);
+      for (const pid of removed) await apiV26.projects.setPm(pid, null);
+      const names = nextIds
+        .map((id) => data.lookup.projects.find((p) => p.id === id)?.name)
+        .filter(Boolean)
+        .join("، ");
+      toast.success(
+        nextIds.length
+          ? `پروژه‌های «${u.first_name} ${u.last_name}» به‌روزرسانی شد: ${names} ✓`
+          : `«${u.first_name} ${u.last_name}» از همه‌ی پروژه‌ها جدا شد`,
+      );
       await loadUsers();
       await data.refresh();
       refreshProcurementStore();
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در اتصال مدیر به پروژه");
+      toast.error(err instanceof Error ? err.message : "خطا در به‌روزرسانی پروژه‌ها");
+      await loadUsers(); // وضعیت واقعی سرور را برگردان
     } finally {
       setBusyId(null);
     }
@@ -149,7 +169,13 @@ export function OrganizationPage() {
     }
   };
 
-  const pmOf = (projectId: string) => users.find((u) => u.role === "pm" && u.project_id === projectId) || null;
+  // مدیرِ مسئول یک پروژه (1:N — کاربر ممکن است مدیر چند پروژه باشد)
+  const pmOf = (projectId: string) =>
+    users.find(
+      (u) =>
+        u.role === "pm" &&
+        (u.projects?.some((p) => p.id === projectId) || u.project_id === projectId),
+    ) || null;
 
   return (
     <div className="min-h-screen">
@@ -226,19 +252,14 @@ export function OrganizationPage() {
                           <small className="block text-[10px] text-muted">(تغییر نقش فقط توسط ادمین)</small>
                         )}
                       </td>
-                      <td className="py-1.5 pe-3">
+                      <td className="min-w-[240px] py-1.5 pe-3 align-top">
                         {u.role === "pm" ? (
-                          <select
-                            className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px]"
-                            value={u.project_id || ""}
+                          <ProjectMultiSelect
+                            options={data.lookup.projects.map((p) => ({ id: p.id, name: p.name }))}
+                            values={assignedProjectsOf(u).map((p) => p.id)}
+                            onChange={(ids) => void syncUserProjects(u, ids)}
                             disabled={busyId === u.id}
-                            onChange={(e) => void changeProject(u, e.target.value)}
-                          >
-                            <option value="">— بدون پروژه —</option>
-                            {data.lookup.projects.map((p) => (
-                              <option key={p.id} value={p.id}>{p.name}</option>
-                            ))}
-                          </select>
+                          />
                         ) : (
                           <span className="text-[11.5px] text-muted">—</span>
                         )}
@@ -253,7 +274,9 @@ export function OrganizationPage() {
                 </tbody>
               </table>
               <div className="mt-1 text-[11px] text-muted">
-                «بدون نقش» = حذف مدیر پروژه (از پروژه هم جدا می‌شود). اتصال به یک پروژه، مدیر قبلی آن پروژه را جابه‌جا می‌کند.
+                «بدون نقش» = حذف مدیر پروژه (از همه‌ی پروژه‌ها هم جدا می‌شود). هر مدیر پروژه می‌تواند به
+                چند پروژه متصل باشد؛ حذف هر چیپ (×)، فقط همان پروژه را جدا می‌کند و اتصال به یک پروژه، مدیرِ
+                قبلیِ آن پروژه را جابه‌جا می‌کند.
               </div>
             </div>
           )}
@@ -294,11 +317,11 @@ export function OrganizationPage() {
                   <div className="mb-2 flex flex-col gap-1.5">
                     {whs.map((w) => (
                       <div key={w.id} className="flex items-center justify-between gap-2 rounded-lg border border-line px-3 py-2 text-[12.5px]">
-                        <div className="min-w-0">
+                        <div className="min-w-0 flex-1">
                           <b>{w.name}</b>
                           <small className="block truncate text-muted">{w.description || ""}</small>
                         </div>
-                        <div className="flex items-center gap-1.5">
+                        <div className="flex flex-wrap items-center justify-end gap-1.5">
                           <button
                             className="rounded-lg border border-accent/40 bg-accent/5 px-2 py-1 text-[10.5px] font-bold text-accent"
                             onClick={() => navigate(`/inventory?warehouse=${w.id}`)}
@@ -322,20 +345,20 @@ export function OrganizationPage() {
                     ))}
                   </div>
                 )}
-                <div className="flex gap-2">
+                <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
                   <input
-                    className="h-8 w-44 rounded-lg border border-line bg-panel px-2 text-sm"
+                    className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-sm sm:w-44"
                     placeholder="نام انبار جدید"
                     value={newWh[p.id] || ""}
                     onChange={(e) => setNewWh((s) => ({ ...s, [p.id]: e.target.value }))}
                   />
                   <input
-                    className="h-8 w-52 rounded-lg border border-line bg-panel px-2 text-sm"
+                    className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-sm sm:w-52"
                     placeholder="توضیحات (اختیاری)"
                     value={newWhDesc[p.id] || ""}
                     onChange={(e) => setNewWhDesc((s) => ({ ...s, [p.id]: e.target.value }))}
                   />
-                  <button className="rounded-lg bg-accent px-3 py-1.5 text-[12px] font-bold text-white" onClick={() => void addWarehouse(p.id)}>
+                  <button className="w-full rounded-lg bg-accent px-3 py-2 text-[12px] font-bold text-white sm:w-auto sm:py-1.5" onClick={() => void addWarehouse(p.id)}>
                     + افزودن انبار
                   </button>
                 </div>

frontend/src/pages/Inventory/useInventoryData.ts

@@ -54,6 +54,9 @@ export function useInventoryData(): InventoryData {
       setWarehouses(whs);
       setInventory(inv);
       setTransactions(txs);
+    } catch {
+      // پروژه‌ی فعال ممکن است همین حالا باطل شده باشد — گیتِ پروژه در سطح مسیر
+      // (RequirePmProjects) پروژه‌ی جایگزین/صفحه‌ی خالی را نشان می‌دهد.
     } finally {
       setLoading(false);
     }

frontend/src/pages/Suppliers/PurchaseHistory.tsx

@@ -112,28 +112,28 @@ export function PurchaseHistory({ supplier, quotes, materials }: PurchaseHistory
               ) : (
                 <>
                   {profs.map((pf) => (
-                    <a
+                    <button
                       key={"pf-" + pf.id}
+                      type="button"
                       className="detail-link"
-                      href={api.files.downloadUrl(q.id, "proforma", pf.id!)}
-                      download={pf.name}
                       title="دانلود پیش‌فاکتور"
+                      onClick={() => api.files.download(q.id, "proforma", pf.id!, pf.name)}
                     >
                       <Paperclip className="me-1 inline h-3 w-3" />
                       پیش‌فاکتور: {pf.name}
-                    </a>
+                    </button>
                   ))}
                   {invs.map((inv) => (
-                    <a
+                    <button
                       key={"inv-" + inv.id}
+                      type="button"
                       className="detail-link"
-                      href={api.files.downloadUrl(q.id, "invoice", inv.id!)}
-                      download={inv.name}
                       title="دانلود فاکتور"
+                      onClick={() => api.files.download(q.id, "invoice", inv.id!, inv.name)}
                     >
                       <Paperclip className="me-1 inline h-3 w-3" />
                       فاکتور: {inv.name}
-                    </a>
+                    </button>
                   ))}
                   {!loading && !profs.length && !invs.length && (
                     <span className="ph-attach-loading">فاکتوری ثبت نشده</span>

frontend/src/pages/Wizard/Step1TopicSupplier.tsx

@@ -103,7 +103,7 @@ export function Step1TopicSupplier({
               ))
             )}
           </div>
-          <div className={cn("field max-w-md", invalid && "invalid")}>
+          <div data-field="supplier_id" className={cn("field max-w-md", invalid && "invalid")}>
             <label>یا نام تأمین‌کننده را تایپ و انتخاب کنید</label>
             <Combobox
               value={supplierName}

frontend/src/pages/Wizard/Step2LineItems.tsx

@@ -41,28 +41,33 @@ export function itemRowLabel(it: ItemDraft): string {
   return qtyPart ? `${name} -- ${qtyPart}` : name;
 }
 
-// نام پایه‌ی متریال از نامِ ذخیره‌شده: پیشوند برند و پسوند مشخصه حذف می‌شوند
-// («راجین سیم مسی» → «سیم») — پیشنهادهای فیلد «متریال» فقط خودِ متریال را نشان
-// می‌دهند؛ برند و مشخصه ستون‌های جداگانه دارند.
-function materialBaseName(name: string, brand: string, specs: string[]): string {
-  let base = (name || "").trim();
-  if (!base) return "";
-  if (brand) {
-    if (base.startsWith(brand)) base = base.slice(brand.length);
-    else if (base.includes(brand)) base = base.split(brand).join(" ");
+// نام پایه‌ی متریال از نامِ ذخیره‌شده.
+// متریال‌های جدید فقط نامِ خودِ متریال را در name دارند (برند در brand_ids و
+// مشخصه‌ها در attributes ذخیره می‌شوند) و دست‌نخورده برمی‌گردند. رکوردهای قدیمی
+// name را به شکل «برند + دسته + مشخصه» ذخیره کرده‌اند؛ آن قطعات جدا می‌شوند تا
+// نامِ پایه باقی بماند.
+function materialBaseName(name: string, brand: string, specs: string[], category = ""): string {
+  const fallback = (name || "").trim();
+  if (!fallback) return "";
+  let base = fallback;
+  // بلندترین قطعه اول حذف می‌شود تا حذف‌های جزئی، رشته را ناقص نکنند
+  const parts = [brand, category, ...specs]
+    .map((p) => (p || "").trim())
+    .filter(Boolean)
+    .sort((a, b) => b.length - a.length);
+  for (const p of parts) {
+    if (!base.includes(p)) continue;
+    const next = base.split(p).join(" ").replace(/\s+/g, " ").trim();
+    // اگر حذفِ این قطعه کلِ نام را خالی کند، یعنی همان نامِ متریال بوده — نگهش دار
+    if (!next) continue;
+    base = next;
   }
-  specs
-    .filter((s) => s && s.trim())
-    .forEach((s) => {
-      if (base.includes(s)) base = base.split(s).join(" ");
-    });
-  base = base.replace(/\s+/g, " ").trim();
-  return base || (name || "").trim();
+  // شکلِ قدیمیِ خراب می‌تواند فقط یک مشخصه باقی بگذارد؛ آن دیگر نامِ متریال نیست
+  if (parts.some((p) => p === base)) return fallback;
+  return base || fallback;
 }
 
-// مقادیر مجزای category/brand/spec داخل تاپیک — با فیلتر پله‌به‌پله (تاپیک → دسته → برند)
-// + مقادیر تایپ‌شده در همه‌ی سطرهای قبلی (suggestion از همه‌ی فیلدها)
-// نکته: برند و واحد از همه‌ی دسته‌ها نمایش داده می‌شوند (issue #7)
+// مقادیر مجزای category/brand/spec داخل تاپیک
 export function materialOptions(
   materials: Material[],
   topic: string,
@@ -70,12 +75,11 @@ export function materialOptions(
   field: "cat" | "brand" | "spec",
   allItems: ItemDraft[] = [],
   apiBrands: string[] = [],
+  apiSpecs: string[] = [],
 ): string[] {
   let list = materials.filter((m) => topic && normalize(m.topic) === normalize(topic));
   const cat = item.cat.trim();
-  const brand = item.brand.trim();
 
-  // مقادیر واردشده در سطرهای دیگر — برای پیشنهاد در سطرهای جدید
   const fromRows = (sel: (it: ItemDraft) => string | string[]): string[] => {
     const out = new Set<string>();
     allItems.forEach((it) => {
@@ -92,16 +96,21 @@ export function materialOptions(
     fromRows((it) => it.cat).forEach((c) => base.add(c));
     return [...base].sort((a, b) => a.localeCompare(b, "fa"));
   }
-  if (cat) list = list.filter((m) => normalize(m.category) === normalize(cat));
   if (field === "brand") {
-    // همه‌ی برندها از همه‌ی materials + برندهای ثبت‌شده در بخش برندها (بک‌اند)
+    // برند سراسری است — مستقل از تاپیک و دسته
     const allBrands = new Set(materials.map((m) => m.brand).filter(Boolean));
     apiBrands.forEach((b) => b && allBrands.add(b));
     fromRows((it) => it.brand).forEach((b) => allBrands.add(b));
     return [...allBrands].sort((a, b) => a.localeCompare(b, "fa"));
   }
-  if (brand) list = list.filter((m) => normalize(m.brand) === normalize(brand));
-  const base = new Set(list.flatMap((m) => (m.specs || []).filter(Boolean)));
+  if (cat) list = list.filter((m) => normalize(m.category) === normalize(cat));
+  // مشخصه‌ها سراسری هستند: رجیستری attribute-definitions + مشخصه‌های همه‌ی
+  // متریال‌ها + مشخصه‌های تایپ‌شده در سایر ردیف‌ها. به تاپیک/دسته/برندِ قلمِ
+  // فعلی گره نمی‌خورند تا هنگام افزودن پیشنهاد جدید همیشه در دسترس باشند.
+  const base = new Set<string>();
+  apiSpecs.forEach((s) => s && base.add(s));
+  materials.forEach((m) => (m.specs || []).forEach((s) => s && base.add(s)));
+  list.forEach((m) => (m.specs || []).forEach((s) => s && base.add(s)));
   fromRows((it) => it.specs).forEach((s) => base.add(s));
   return [...base].sort((a, b) => a.localeCompare(b, "fa"));
 }
@@ -110,32 +119,29 @@ export function materialOptions(
 export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember }: Step2Props) {
   const materials = useMaterials();
 
-  // واحدها از بک‌اند خوانده می‌شوند + واحدهای واردشده در سطرهای قبلی
   const [unitOptions, setUnitOptions] = useState<string[]>(() => {
     const all = new Set<string>();
     items.forEach((it) => { if (it.unit) all.add(it.unit); });
     return [...all];
   });
-  // واحدهای موجود (دیتابیس) + واحدهای تایپ‌شده در سطرهای دیگر
+
   const allUnits = useMemo(() => {
     const out = new Set(unitOptions);
     items.forEach((it) => { if (it.unit) out.add(it.unit); });
     return [...out];
   }, [items, unitOptions]);
 
-  // نام‌های پایه‌ی یکتای همه‌ی متریال‌های کاتالوگ سراسری (فقط خود متریال،
-  // بدون برند/مشخصه — آن‌ها ستون‌های خودشان را دارند)
   const allMaterialNames = useMemo(() => {
     const set = new Set<string>();
     materials.forEach((m) => {
-      const base = materialBaseName(m.name, m.brand, m.specs);
+      const base = materialBaseName(m.name, m.brand, m.specs, m.category);
       if (base) set.add(base);
     });
     return [...set].sort((a, b) => a.localeCompare(b, "fa"));
   }, [materials]);
 
-  // برندهای ثبت‌شده در بخش برندها (بک‌اند) — به‌علاوه‌ی برندهای متریال‌ها
   const [brandOptions, setBrandOptions] = useState<string[]>([]);
+  const [specOptions, setSpecOptions] = useState<string[]>([]);
 
   useEffect(() => {
     let alive = true;
@@ -146,11 +152,15 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
         list.forEach((u) => { if (u.name_fa || u.code) merged.add(u.name_fa || u.code); });
         return [...merged];
       }))
-      .catch(() => { /* بک‌اند در دسترس نیست */ });
+      .catch(() => {});
     void api
       .brandsList()
       .then((list) => alive && setBrandOptions(list.map((b) => b.name).filter(Boolean)))
-      .catch(() => { /* بک‌اند در دسترس نیست */ });
+      .catch(() => {});
+    void api
+      .specsList()
+      .then((list) => alive && setSpecOptions(list))
+      .catch(() => {});
     return () => { alive = false; };
   }, []);
 
@@ -163,14 +173,12 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
   };
 
   const add = () => {
-    // سطر جدید — مقدارها خالی؛ پیشنهادها از همه‌ی سطرهای قبلی می‌آیند
     onItemsChange([
       ...items,
       { tempId: "it" + Date.now() + Math.random().toString(36).slice(2, 6), cat: "", brand: "", specs: [], qty: null, unit: "", price: null, total: null },
     ]);
   };
 
-  // یادآوری یک فیلد تایپ‌شده برای پیشنهادهای آینده (داخل تاپیک)
   const rememberField = (field: "i-cat" | "i-brand" | "i-spec", it: ItemDraft) => {
     if (!selectedTopic) return;
     let rec: MaterialRec;
@@ -198,10 +206,10 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
   return (
     <div>
       <h3 className="mb-1 text-[15px] font-bold">
-        <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-accent text-[12px] font-bold text-white">۲</span>
+        <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-blue-600 text-[12px] font-bold text-white">۲</span>
         اقلام سفارش
       </h3>
-      <div className="mb-3 text-[12px] text-muted" dangerouslySetInnerHTML={{ __html: 'هر سطر یک <b>قلم</b> است (متریال + برند + مشخصه + واحد + تعداد + قیمت). متریال، برند و مشخصه را می‌توان از گزینه‌ها انتخاب کرد یا تایپ کرد تا به‌عنوان گزینه‌ی جدید اضافه شود. شرایط پرداخت هر قلم را در مرحله‌ی بعد مشخص می‌کنید.' }} />
+      <div className="mb-3 text-[12px] text-gray-500" dangerouslySetInnerHTML={{ __html: 'هر سطر یک <b>قلم</b> است (متریال + برند + مشخصه + واحد + تعداد + قیمت). متریال، برند و مشخصه را می‌توان از گزینه‌ها انتخاب کرد یا تایپ کرد تا به‌عنوان گزینه‌ی جدید اضافه شود. شرایط پرداخت هر قلم را در مرحله‌ی بعد مشخص می‌کنید.' }} />
 
       <div className="item-row wizard-item-row item-row-head mb-1 pe-7">
         <span>متریال</span>
@@ -213,14 +221,12 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
         <span>قیمت کل</span>
       </div>
 
-      <div className="flex flex-col gap-2">
+      <div data-field="line_items" className="flex flex-col gap-2">
         {items.map((it) => (
-          <div key={it.tempId} className="item-row wizard-item-row">
+          <div key={it.tempId} className="item-row wizard-item-row items-center">
             <Combobox
               value={it.cat}
               onChange={(x) => patch(it.tempId, { cat: x.label })}
-              // پیشنهادها: همه‌ی متریال‌های کاتالوگ سراسری با نام واقعی‌شان
-              // (بدون فیلتر تاپیک) — انتخابِ یک متریال موجود در ذخیره، همان را reuse می‌کند
               items={allMaterialNames}
               allowAdd
               addSuffix="به عنوان متریال جدید"
@@ -245,7 +251,7 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
             <MultiSelectCombobox
               values={it.specs}
               onChange={(specs) => patch(it.tempId, { specs })}
-              options={materialOptions(materials, selectedTopic, it, "spec", items)}
+              options={materialOptions(materials, selectedTopic, it, "spec", items, [], specOptions)}
               placeholder="مشخصه"
               className="min-w-0"
             />
@@ -263,30 +269,22 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
             <Combobox
               value={it.unit}
               onChange={(x) => patch(it.tempId, { unit: x.label })}
-              // متنِ خودِ همین سطر از پیشنهادها حذف می‌شود؛ وگرنه متن تایپ‌شده
-              // «تطبیق دقیق» پیدا می‌کرد و گزینه‌ی «به عنوان واحد جدید» هرگز ظاهر نمی‌شد
               items={allUnits.filter((u) => normalize(u) !== normalize(it.unit))}
               allowAdd
               addSuffix="به عنوان واحد جدید"
               placeholder="واحد"
               onInputChange={(v) => patch(it.tempId, { unit: v })}
               onAdd={(v) => {
-                // انتخاب گزینه‌ی «+ [واحد] به عنوان واحد جدید» → ثبت فوری در دیتابیس؛
-                // نامِ تایپ‌شده هم روی همان قلم اعمال می‌شود (onInputChange بالا)
                 const name = v.trim();
                 if (!name) return;
                 void apiV26.catalog
                   .createUnit(name)
                   .then(() => {
-                    // بعد از ثبت، واحد برای سطرهای بعدی هم پیشنهاد شود
                     setUnitOptions((prev) =>
                       prev.some((u) => normalize(u) === normalize(name)) ? prev : [...prev, name],
                     );
                   })
-                  .catch(() => {
-                    // اگر واحدِ همنام در همین لحظه ساخته شده باشد (تداخل 409) یا شبکه
-                    // خطا دهد، هنگام ذخیره‌ی پیشنهاد دوباره resolve می‌شود — خطای بلوک‌کننده نیست
-                  });
+                  .catch(() => {});
               }}
               inputClassName="!text-[12px] !h-9"
               className="min-w-0"
@@ -315,16 +313,31 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
               placeholder="قیمت کل"
               showWords
             />
-            <button type="button" className="cursor-pointer text-muted hover:text-red" title="حذف" onClick={() => remove(it.tempId)}>
-              ×
+            
+            {/* دکمه حذف مدرن با آیکون سطل زباله */}
+            <button
+              type="button"
+              className="flex h-8 w-8 items-center justify-center rounded-lg text-gray-400 hover:bg-red-50 hover:text-red-500 transition-colors"
+              title="حذف قلم"
+              onClick={() => remove(it.tempId)}
+            >
+              <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={1.8} d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+              </svg>
             </button>
           </div>
         ))}
       </div>
 
-      <button type="button" className="btn-line-file mt-2.5" onClick={add}>
-        ＋ افزودن قلم
+      {/* دکمه افزودن قلم با استایل برجسته و خط‌چین */}
+      <button
+        type="button"
+        className="mt-3 flex w-full items-center justify-center gap-2 rounded-xl border-2 border-dashed border-blue-300 bg-blue-50/40 py-2.5 px-4 text-[13px] font-semibold text-blue-600 hover:border-blue-500 hover:bg-blue-100/70 transition-all duration-150"
+        onClick={add}
+      >
+        <span className="text-base font-bold leading-none">+</span>
+        <span>افزودن قلم جدید</span>
       </button>
     </div>
   );
-}
+}

frontend/src/pages/Wizard/Step3Termsheets.tsx

@@ -47,7 +47,7 @@ export function Step3Termsheets({ cards, onCardsChange, items, coverage, onCover
       </h3>
       <div className="mb-3 text-[12px] text-muted" dangerouslySetInnerHTML={{ __html: 'هر <b>termsheet</b> یک روش پرداخت است (نقد، چک، اقساط...). داخل هر termsheet مشخص کنید کدام قلم‌ها را پوشش می‌دهد — یک termsheet می‌تواند چند قلم را بگیرد، و یک قلم هم می‌تواند زیر چند termsheet مختلف (مثلاً هم نقد هم چک) پیشنهاد شود.' }} />
 
-      <div className="flex flex-col gap-3">
+      <div data-field="termsheets" className="flex flex-col gap-3">
         {cards.map((card, idx) => (
           <TermsheetCard
             key={card.key}

frontend/src/pages/Wizard/Step4Projects.tsx

@@ -155,7 +155,7 @@ export function Step4Projects({ items, projects, assignment, onAssign, onUnassig
   };
 
   return (
-    <div>
+    <div data-field="project">
       <h3 className="mb-1 text-[15px] font-bold">
         <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-accent text-[12px] font-bold text-white">۴</span>
         پروژه‌ها

frontend/src/pages/Wizard/Step5Review.tsx

@@ -2,7 +2,6 @@ import { Paperclip } from "lucide-react";
 import { faNum } from "../../lib/formatters";
 import { groupCommas } from "../../lib/numutil";
 import { JalaliDatePicker } from "../../components/JalaliDatePicker";
-import { FileUpload } from "../../components/FileUpload";
 
 export interface Step5Props {
   quoteDate: string | null;
@@ -52,22 +51,26 @@ export function Step5Review({
   return (
     <div>
       <h3 className="mb-3 text-[15px] font-bold">
-        <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-accent text-[12px] font-bold text-white">۵</span>
+        <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-blue-600 text-[12px] font-bold text-white">۵</span>
         تاریخ، یادداشت و بازبینی نهایی
       </h3>
 
-      <div className="grid max-w-2xl grid-cols-2 gap-3 max-md:grid-cols-1">
-        <div className="field">
+      <div className="grid max-w-2xl grid-cols-12 gap-3">
+        {/* تاریخ پیشنهاد: فضای بزرگتر (۷ ستون از ۱۲) به همراه ساعت */}
+        <div className="field col-span-7 [&>div]:w-full [&_input]:w-full" data-field="quote_date">
           <label>تاریخ پیشنهاد</label>
           <JalaliDatePicker value={quoteDate} onChange={onQuoteDate} placeholder="۱۴۰۳/۰۵/۱۲" withTime />
           <div className="hint">پیش‌فرض امروز</div>
         </div>
-        <div className="field">
+
+        {/* تاریخ انقضای پیشنهاد: فضای کوچکتر (۵ ستون از ۱۲) */}
+        <div className="field col-span-5 [&>div]:w-full [&_input]:w-full" data-field="expiry_date">
           <label>تاریخ انقضای پیشنهاد</label>
           <JalaliDatePicker value={expiryDate} onChange={onExpiryDate} placeholder="۱۴۰۳/۰۶/۱۲" />
           <div className="hint">تا چه زمانی این قیمت معتبر است؟</div>
         </div>
-        <div className="field col-span-2">
+
+        <div className="field col-span-12" data-field="notes">
           <label>یادداشت (اختیاری)</label>
           <textarea
             rows={2}
@@ -77,20 +80,45 @@ export function Step5Review({
             onChange={(e) => onNotes(e.target.value)}
           />
         </div>
-        <div className="field col-span-2">
+
+        <div className="field col-span-12" data-field="proforma">
           <label>پیش‌فاکتور (اختیاری)</label>
           {proforma ? (
-            <div className="inv-row">
-              <span className="inv-name">
-                <Paperclip className="me-1 inline h-3.5 w-3.5" />
-                {proforma.name}
-              </span>
-              <button type="button" className="inv-x" title="حذف" onClick={() => onProforma(null)}>
-                ×
+            /* وضعیت فایل انتخاب‌شده با دکمه حذف تمیز */
+            <div className="flex items-center justify-between rounded-xl border border-gray-200 bg-gray-50/70 px-3 py-2 text-xs">
+              <div className="flex items-center gap-2 truncate text-gray-700">
+                <Paperclip className="h-4 w-4 text-blue-600 shrink-0" />
+                <span className="font-medium truncate">{proforma.name}</span>
+                <span className="text-[11px] text-gray-400 shrink-0">
+                  ({Math.round(proforma.size / 1024)} کیلوبایت)
+                </span>
+              </div>
+              <button
+                type="button"
+                className="flex h-7 w-7 items-center justify-center rounded-lg text-gray-400 hover:bg-red-50 hover:text-red-500 transition-colors"
+                title="حذف فایل"
+                onClick={() => onProforma(null)}
+              >
+                <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                  <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={1.8} d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                </svg>
               </button>
             </div>
           ) : (
-            <FileUpload onUpload={onProforma} label="انتخاب فایل پیش‌فاکتور" />
+            /* دکمه آپلود مینیمال با حاشیه خط‌چین ملایم */
+            <label className="inline-flex cursor-pointer items-center gap-2 rounded-xl border border-dashed border-gray-300 bg-gray-50/50 px-4 py-2 text-xs font-medium text-gray-600 hover:border-blue-500 hover:bg-blue-50/40 hover:text-blue-600 transition-all">
+              <Paperclip className="h-4 w-4 text-gray-400" />
+              <span>انتخاب یا پیوست فایل پیش‌فاکتور</span>
+              <input
+                type="file"
+                className="hidden"
+                accept=".pdf,.png,.jpg,.jpeg,.xlsx,.xls,.docx"
+                onChange={(e) => {
+                  const f = e.target.files?.[0];
+                  if (f) onProforma(f);
+                }}
+              />
+            </label>
           )}
         </div>
       </div>
@@ -114,4 +142,4 @@ export function Step5Review({
       </div>
     </div>
   );
-}
+}

frontend/src/pages/Wizard/WizardPage.tsx

@@ -1,8 +1,10 @@
 import { useEffect, useMemo, useState } from "react";
+import { track } from "../../lib/analytics";
 import { Link, useNavigate, useSearchParams } from "react-router-dom";
+import { ChevronRight, ChevronLeft, Check } from "lucide-react";
 import { toast } from "sonner";
 import type { LineItem, Quote } from "../../lib/types";
-import { api, nextId } from "../../lib/api";
+import { api, ApiError, looksLikeUuid, nextId } from "../../lib/api";
 import {
   useAddMaterial,
   useAddProject,
@@ -73,18 +75,15 @@ export function WizardPage() {
   const [assignment, setAssignment] = useState<Record<string, string[]>>({});
 
   const [quoteDate, setQuoteDate] = useState<string | null>(() => {
-    // تاریخ پیشنهاد: همین الان (ساعت و دقیقه‌ی فعلی) — نه نیمه‌شب
     return new Date().toISOString();
   });
   const [expiryDate, setExpiryDate] = useState<string | null>(null);
   const [notes, setNotes] = useState("");
   const [proforma, setProforma] = useState<File | null>(null);
-  // دیالوگ ذخیره با فیلدهای خالی (نام فیلد + مرحلهی مربوطه)
   const [emptyFields, setEmptyFields] = useState<{ label: string; step: number }[]>([]);
   const [confirmOpen, setConfirmOpen] = useState(false);
 
   // ---------- prefill از لینک‌ها (?topic=&supplier=) ----------
-  // وقتی suppliers هنوز لود نشده، دوباره اجرا می‌شود
   useEffect(() => {
     const t = params.get("topic");
     if (!t) return;
@@ -102,23 +101,17 @@ export function WizardPage() {
   }, [params, suppliers, topics]);
 
   // ---------- اعتبارسنجی قبل از ترک هر مرحله ----------
-  // مراحل تکمیل‌شده را بر اساس داده‌های فعلی مشخص می‌کند
   const completedSteps = useMemo(() => {
     const s = new Set<number>();
-    // مرحله ۱: تاپیک انتخاب شده + نام تأمین‌کننده پر شده
     if (selectedTopic && supplierName.trim()) s.add(1);
-    // مرحله ۲: حداقل یک قلم با تعداد و قیمت
     if (items.length > 0 && items.some((it) => it.qty != null && it.qty !== 0 && it.price != null && it.price !== 0)) s.add(2);
-    // مرحله ۳: حداقل یک termsheet با مایل‌ستون واقعی (تاریخ یا مبلغ) — نه فقط کارت پیش‌فرض
     if (
       cards.length > 0 &&
       cards.some((card) => (card.milestones || []).some((m) => m.when_iso || (m.amount != null && m.amount !== 0)))
     ) {
       s.add(3);
     }
-    // مرحله ۴: همه اقلام حداقل به یک پروژه اختصاص داده شده
     if (items.length > 0 && items.every((it) => (assignment[it.tempId] || []).length > 0)) s.add(4);
-    // مرحله ۵: همیشه بازدیدشده محسوب می‌شود
     if (highestVisited >= 5) s.add(5);
     return s;
   }, [selectedTopic, supplierName, items, cards, coverage, assignment, highestVisited]);
@@ -126,6 +119,7 @@ export function WizardPage() {
   const goToStep = (n: number) => {
     setCurrentStep(n);
     setHighestVisited((h) => Math.max(h, n));
+    track("wizard_step", { step: n, direction: n > currentStep ? "forward" : "back" });
     window.scrollTo({ top: 0, behavior: "smooth" });
   };
 
@@ -133,16 +127,8 @@ export function WizardPage() {
     goToStep(currentStep + 1);
   };
 
-  const rememberMaterial = (rec: MaterialRec) => {
-    void addMaterial.mutateAsync({
-      id: nextId("m", materials),
-      name: [rec.brand, rec.category, ...rec.specs].filter(Boolean).join(" ") || "کالای جدید",
-      topic: rec.topic,
-      category: rec.category,
-      brand: rec.brand,
-      specs: rec.specs,
-      base_unit: "",
-    });
+  const rememberMaterial = (_rec: MaterialRec) => {
+    // رکوردهای متریال به همراه واحد و مشخصه‌ها در زمان ذخیره نهایی ساخته می‌شوند
   };
 
   // ---------- پروژه‌ها: از مجموعه + نام‌های قدیمی quoteها ----------
@@ -200,144 +186,194 @@ export function WizardPage() {
   }, [items, assignment, cards, coverage, supplierName, selectedTopic, isOfficial]);
 
   // ---------- ذخیره ----------
-  // تابع ذخیره‌ی اصلی — با یا بدون فیلدهای خالی (انتخاب کاربر در دیالوگ)
   const doSave = async () => {
-      // خطای بخش — با دکمه‌ی «رفع خطا» که به همان بخش می‌برد
-      const sectionError = (step: number, title: string, err: unknown) => {
-        const msg = err instanceof Error ? err.message : "خطای ناشناخته";
-        toast.error(`${title}: ${msg}`, {
-          action: { label: "رفع خطا", onClick: () => goToStep(step) },
-        });
-      };
-      // مشخص کردن بخش خطا از روی متن پیام
-      const guessStep = (msg: string): number => {
-        if (/تأمین|تامین|supplier/i.test(msg)) return 1;
-        if (/متریال|واحد|قلم|خط آیتم|item|دسته/i.test(msg)) return 2;
-        if (/ترم|termsheet|پرداخت|پوشش/i.test(msg)) return 3;
-        if (/پروژه|project/i.test(msg)) return 4;
-        return 5;
-      };
-
-      // تأمین‌کننده
-      const name = supplierName.trim();
-      let supplierId = "";
-      if (name) {
-        const exist = suppliers.find((s) => normalize(s.name) === normalize(name));
-        if (exist) {
-          supplierId = exist.id;
-        } else {
-          try {
-            const created = await addSupplier.mutateAsync({
-              id: nextId("s", suppliers),
-              topic: selectedTopic,
-              categories: [],
-              name,
-              location: newSup.location.trim(),
-              phone: newSup.phone.trim(),
-              contact: newSup.contact.trim(),
-            });
-            supplierId = created.id;
-          } catch (err) {
-            sectionError(1, "خطا در بخش تأمین‌کننده", err);
-            return;
-          }
+    const resolveErrorTarget = (err: unknown): { step: number; field?: string } => {
+      let field = "";
+      let msg = "";
+      if (err instanceof ApiError) {
+        field = err.field || "";
+        msg = err.message || "";
+      } else if (err instanceof Error) {
+        msg = err.message || "";
+        if ("field" in err && typeof (err as any).field === "string") {
+          field = (err as any).field;
         }
       }
 
-      // اقلام
-      const collected: { li: LineItem; tempId: string }[] = [];
-      for (const it of items) {
-        const cat = it.cat.trim();
-        const brand = it.brand.trim();
-        const specs = it.specs;
-        const unit = it.unit.trim();
-        const qty = it.qty;
-        const price = it.price;
-        const total = it.total;
-        if (!cat && !brand && qty == null && price == null) continue;
+      const combined = `${field} ${msg}`.toLowerCase();
 
-        // جستجوی متریال: اول با نامِ کامل سراسری (دیتابیس) — بدون قید دسته/تاپیک،
-        // چون دسته‌ی ذخیره‌شده‌ی متریال‌ها نام تاپیک است نه نام تایپ‌شده‌ی کاربر
-        const wantName = [brand, cat, ...specs].filter(Boolean).join(" ") || "کالای جدید";
-        let material = materials.find((m) => normalize(m.name) === normalize(wantName));
-        if (!material) {
-          // جستجوی قبلی (برند و مشخصه‌ی ساختارمند در همین نشست)
-          material = materials.find(
-            (m) =>
-              normalize(m.category) === normalize(cat) &&
-              normalize(m.brand) === normalize(brand) &&
-              specsKey(m.specs) === specsKey(specs),
-          );
-        }
-        let materialId: string;
-        if (material) {
-          materialId = material.id;
-        } else {
-          try {
-            const created = await addMaterial.mutateAsync({
-              id: nextId("m", materials),
-              name: wantName,
-              topic: selectedTopic,
-              category: cat,
-              brand,
-              specs,
-              base_unit: unit,
-            });
-            materialId = created.id; // UUID واقعی از بک‌اند
-          } catch (err) {
-            sectionError(2, "خطا در بخش اقلام (متریال)", err);
-            return;
-          }
-        }
+      // ۱. تأمین‌کننده
+      if (/supplier|تأمین|تامین/i.test(combined)) return { step: 1, field: "supplier_id" };
 
-        collected.push({
-          li: {
-            id: "li-" + (collected.length + 1),
-            material_id: materialId,
-            quantity: qty,
-            unit,
-            unit_price: price,
-            total_price: total,
-            termsheet_ids: [],
-            accepted_ts_id: null,
-            rejected: false,
-            arrived_date: null,
+      // ۲. اقلام / متریال / واحد / تعداد / قیمت
+      if (/line_item|material|canonical_unit|unit_id|quantity|متریال|واحد|قلم|تعداد/i.test(combined)) {
+        return { step: 2, field: field || "line_items" };
+      }
+
+      // ۳. شرایط پرداخت / termsheet / مراحل پرداخت / سررسید
+      if (/termsheet|item_termsheet|schedule_step|due_date|milestone|ترم|پرداخت|پوشش|سررسید/i.test(combined)) {
+        return { step: 3, field: field || "termsheets" };
+      }
+
+      // ۴. پروژه
+      if (/project|پروژه/i.test(combined)) return { step: 4, field: "project" };
+
+      // ۵. تاریخ‌ها، یادداشت، پیش‌فاکتور
+      if (/expiry_date|تاریخ انقضا/i.test(combined)) return { step: 5, field: "expiry_date" };
+      if (/quote_date|تاریخ پیشنهاد/i.test(combined)) return { step: 5, field: "quote_date" };
+      if (/proforma|پیش‌فاکتور/i.test(combined)) return { step: 5, field: "proforma" };
+      if (/notes|یادداشت/i.test(combined)) return { step: 5, field: "notes" };
+
+      return { step: 5, field };
+    };
+
+    const sectionError = (stepOrTarget: number | { step: number; field?: string }, title: string, err: unknown) => {
+      const target = typeof stepOrTarget === "number" ? { step: stepOrTarget } : stepOrTarget;
+      const msg = err instanceof Error ? err.message : "خطای ناشناخته";
+      toast.error(`${title}: ${msg}`, {
+        duration: 8000,
+        action: {
+          label: "رفع خطا",
+          onClick: () => {
+            goToStep(target.step);
+            setTimeout(() => {
+              const targetAttr = target.field ? `[data-field="${target.field}"]` : "";
+              const el = (targetAttr ? document.querySelector(targetAttr) : null) ||
+                document.querySelector(`[data-step="${target.step}"]`);
+              if (el instanceof HTMLElement) {
+                el.scrollIntoView({ behavior: "smooth", block: "center" });
+                const input = el.querySelector("input, textarea, select") as HTMLElement | null;
+                if (input) input.focus();
+                else el.focus?.();
+                el.classList.add("ring-2", "ring-red-500", "rounded-xl");
+                setTimeout(() => el.classList.remove("ring-2", "ring-red-500", "rounded-xl"), 3500);
+              }
+            }, 150);
           },
-          tempId: it.tempId,
-        });
+        },
+      });
+    };
+
+    const name = supplierName.trim();
+    let supplierId = "";
+    if (name) {
+      const exist = suppliers.find((s) => normalize(s.name) === normalize(name));
+      if (exist) {
+        supplierId = exist.id;
+      } else {
+        try {
+          const created = await addSupplier.mutateAsync({
+            id: nextId("s", suppliers),
+            topic: selectedTopic,
+            categories: [],
+            name,
+            location: newSup.location.trim(),
+            phone: newSup.phone.trim(),
+            contact: newSup.contact.trim(),
+          });
+          supplierId = created.id;
+        } catch (err) {
+          sectionError(1, "خطا در بخش تأمین‌کننده", err);
+          return;
+        }
+      }
+    }
+
+    const collected: { li: LineItem; tempId: string }[] = [];
+    for (const it of items) {
+      const cat = it.cat.trim();
+      const brand = it.brand.trim();
+      const specs = it.specs;
+      const unit = it.unit.trim();
+      const qty = it.qty;
+      const price = it.price;
+      const total = it.total;
+      if (!cat && !brand && qty == null && price == null) continue;
+
+      const wantName = (cat || brand || specs.join(" ") || "").trim() || "کالای جدید";
+      let material = materials.find((m) => looksLikeUuid(m.id) && normalize(m.name) === normalize(wantName));
+      if (!material) {
+        material = materials.find(
+          (m) =>
+            looksLikeUuid(m.id) &&
+            normalize(m.category) === normalize(cat) &&
+            normalize(m.brand) === normalize(brand) &&
+            specsKey(m.specs) === specsKey(specs),
+        );
+      }
+      // رکوردهای قدیمی name را به شکل «برند + دسته + مشخصه» ذخیره کرده‌اند؛
+      // تطبیق دوم بر اساس category/brand/specs انجام می‌شود تا آن‌ها هم پیدا شوند.
+      if (!material && cat) {
+        material = materials.find(
+          (m) => looksLikeUuid(m.id) && normalize(m.category) === normalize(cat) && normalize(m.brand) === normalize(brand),
+        );
+      }
+      let materialId: string;
+      if (material && looksLikeUuid(material.id)) {
+        materialId = material.id;
+      } else {
+        try {
+          const created = await addMaterial.mutateAsync({
+            id: nextId("m", materials),
+            name: wantName,
+            topic: selectedTopic,
+            category: cat,
+            brand,
+            specs,
+            base_unit: unit || "عدد",
+          });
+          materialId = created.id;
+        } catch (err) {
+          sectionError(2, "خطا در بخش اقلام (متریال)", err);
+          return;
+        }
       }
 
-      const lineItems = collected.map((c) => c.li);
-
-      // termsheetها
-      const termsheets = cards
-        .map((card, i) => ({
-          id: "new-ts-" + (i + 1),
-          label: "گزینه " + faNum(i + 1),
-          milestones: card.milestones.filter((m) => m.when_iso || m.amount != null),
-          status: "offered" as const,
-        }))
-        .filter((t) => t.milestones.length);
-
-      // اتصال اقلام به termsheetها
-      collected.forEach(({ li, tempId }) => {
-        const ids = cards
-          .map((card, i) =>
-            effectiveCovered(cards, coverage, items, card.key).includes(tempId) ? "new-ts-" + (i + 1) : "",
-          )
-          .filter(Boolean);
-        const valid = ids.filter((tid) => termsheets.some((t) => t.id === tid));
-        li.termsheet_ids = valid.length ? valid : termsheets.length ? [termsheets[0].id] : [];
+      collected.push({
+        li: {
+          id: "li-" + (collected.length + 1),
+          material_id: materialId,
+          quantity: qty,
+          unit,
+          unit_price: price,
+          total_price: total,
+          termsheet_ids: [],
+          accepted_ts_id: null,
+          rejected: false,
+          arrived_date: null,
+        },
+        tempId: it.tempId,
       });
+    }
 
-      // پروژه‌ها
-      const projSet = new Set<string>();
-      collected.forEach(({ li, tempId }) => {
-        const list = assignment[tempId] || [];
-        li.projects = list.map((p) => ({ id: "", name: p }));
-        list.forEach((p) => projSet.add(p));
-      });
-      const projectsList = [...projSet];
+    const lineItems = collected.map((c) => c.li);
+
+    const termsheets = cards
+      .map((card, i) => ({
+        id: "new-ts-" + (i + 1),
+        label: "گزینه " + faNum(i + 1),
+        milestones: card.milestones.filter((m) => m.when_iso || m.amount != null),
+        status: "offered" as const,
+      }))
+      .filter((t) => t.milestones.length);
+
+    collected.forEach(({ li, tempId }) => {
+      const ids = cards
+        .map((card, i) =>
+          effectiveCovered(cards, coverage, items, card.key).includes(tempId) ? "new-ts-" + (i + 1) : "",
+        )
+        .filter(Boolean);
+      const valid = ids.filter((tid) => termsheets.some((t) => t.id === tid));
+      li.termsheet_ids = valid.length ? valid : termsheets.length ? [termsheets[0].id] : [];
+    });
+
+    const projSet = new Set<string>();
+    collected.forEach(({ li, tempId }) => {
+      const list = assignment[tempId] || [];
+      li.projects = list.map((p) => ({ id: "", name: p }));
+      list.forEach((p) => projSet.add(p));
+    });
+    const projectsList = [...projSet];
 
     const quoteIso = quoteDate || new Date().toISOString();
     const quote: Quote = {
@@ -361,7 +397,6 @@ export function WizardPage() {
 
     try {
       const created = await createQuote.mutateAsync(quote);
-      // آپلود پیش‌فاکتور به MinIO بعد از ساخت پیشنهاد
       if (proforma) {
         try {
           await api.files.upload(created.id, "proforma", proforma);
@@ -372,14 +407,14 @@ export function WizardPage() {
         }
       }
       toast.success("پیشنهاد ذخیره شد.");
+      track("quote_submitted", { quote_id: created.id, items: lineItems.length });
       navigate("/");
     } catch (e) {
-      const msg = e instanceof Error ? e.message : "خطا در ذخیره پیشنهاد";
-      sectionError(guessStep(msg), "خطا در ثبت پیشنهاد", e);
+      const target = resolveErrorTarget(e);
+      sectionError(target, "خطا در ثبت پیشنهاد", e);
     }
   };
 
-  // ذخیره — اگر بخشی ناقص است، دیالوگ تأیید با لینک فیلدهای خالی باز می‌شود
   const save = () => {
     const incomplete: { label: string; step: number }[] = [];
     if (!completedSteps.has(1)) incomplete.push({ label: "تأمین‌کننده", step: 1 });
@@ -406,7 +441,7 @@ export function WizardPage() {
         <Stepper current={currentStep} highestVisited={highestVisited} completedSteps={completedSteps} onGoto={goToStep} />
 
         {currentStep === 1 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="1" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step1TopicSupplier
               selectedTopic={selectedTopic}
               onTopicSelect={(t) => {
@@ -430,12 +465,12 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 2 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="2" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step2LineItems items={items} onItemsChange={setItems} selectedTopic={selectedTopic} onRemember={rememberMaterial} />
           </div>
         )}
         {currentStep === 3 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="3" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step3Termsheets
               cards={cards}
               onCardsChange={setCards}
@@ -446,7 +481,7 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 4 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="4" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step4Projects
               items={items}
               projects={projectNames}
@@ -460,7 +495,7 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 5 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="5" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step5Review
               quoteDate={quoteDate}
               onQuoteDate={setQuoteDate}
@@ -475,19 +510,54 @@ export function WizardPage() {
           </div>
         )}
 
-        {/* پاورقی ویزارد */}
-        <div className="mt-4 flex items-center gap-2 rounded-xl border border-line bg-panel p-3 shadow-sm">
-          {currentStep > 1 && (
-            <Button variant="slate" onClick={() => goToStep(currentStep - 1)}>
-              ‹ قبلی
-            </Button>
-          )}
-          <div className="flex-1" />
-          <Link to="/" className="btn-line-file no-underline">
-            انصراف
-          </Link>
-          {currentStep < TOTAL_STEPS && <Button onClick={next}>بعدی ›</Button>}
-          {currentStep === TOTAL_STEPS && <Button onClick={() => void save()}>ذخیره پیشنهاد</Button>}
+        {/* پاورقی ویزارد — با آیکون‌های استاندارد و جهت‌گیری دقیق RTL */}
+        <div className="mt-5 flex items-center justify-between rounded-xl border border-line bg-panel p-3.5 shadow-sm">
+          {/* دکمه مرحله قبلی (فلش رو به راست = بازگشت در فارسی) */}
+          <div>
+            {currentStep > 1 && (
+              <button
+                type="button"
+                onClick={() => goToStep(currentStep - 1)}
+                className="inline-flex items-center gap-1.5 px-4 py-2 rounded-xl border border-slate-200 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-slate-700 dark:text-zinc-200 hover:bg-slate-50 dark:hover:bg-zinc-700 text-sm font-medium transition-colors shadow-xs cursor-pointer"
+              >
+                <ChevronRight className="h-4 w-4" />
+                <span>قبلی</span>
+              </button>
+            )}
+          </div>
+
+          {/* دکمه‌های اقدام (انصراف + بعدی / ذخیره) */}
+          <div className="flex items-center gap-3">
+            <Link
+              to="/"
+              className="inline-flex items-center justify-center px-4 py-2 rounded-xl text-sm font-medium text-slate-500 hover:text-slate-700 hover:bg-slate-100 dark:text-zinc-400 dark:hover:text-zinc-200 dark:hover:bg-zinc-800 transition-colors no-underline"
+            >
+              انصراف
+            </Link>
+
+            {/* دکمه مرحله بعدی (فلش رو به چپ = پیشروی در فارسی) */}
+            {currentStep < TOTAL_STEPS && (
+              <button
+                type="button"
+                onClick={next}
+                className="inline-flex items-center gap-1.5 px-6 py-2 rounded-xl bg-blue-600 hover:bg-blue-700 active:bg-blue-800 text-white text-sm font-semibold shadow-sm hover:shadow transition-all duration-150 cursor-pointer"
+              >
+                <span>بعدی</span>
+                <ChevronLeft className="h-4 w-4" />
+              </button>
+            )}
+
+            {currentStep === TOTAL_STEPS && (
+              <button
+                type="button"
+                onClick={() => void save()}
+                className="inline-flex items-center gap-1.5 px-6 py-2 rounded-xl bg-emerald-600 hover:bg-emerald-700 active:bg-emerald-800 text-white text-sm font-semibold shadow-sm hover:shadow transition-all duration-150 cursor-pointer"
+              >
+                <span>ذخیره پیشنهاد</span>
+                <Check className="h-4 w-4" />
+              </button>
+            )}
+          </div>
         </div>
 
         {/* دیالوگ ذخیره با فیلدهای خالی */}
@@ -539,4 +609,4 @@ export function WizardPage() {
       </PageLayout>
     </div>
   );
-}
+}

frontend/src/store/auth.ts

@@ -16,8 +16,9 @@ export interface AuthUser {
   phone: string | null;
   role: "pm" | "procurement_manager" | "admin" | null;
   role_label: string | null;
-  project_id: string | null;
+  project_id: string | null; // پروژه‌ی فعال (PM) — با سوییچر عوض می‌شود
   project_name: string | null;
+  projects?: { id: string; name: string }[]; // همه‌ی پروژه‌های تخصیص‌یافته (1:N)
   display_name: string;
 }
 
@@ -28,6 +29,11 @@ interface AuthStore {
   setToken: (token: string | null) => void;
   setUser: (user: AuthUser | null) => void;
   setDevUser: (role: "pm" | "admin" | "procurement_manager", projectId: string | null, projectName: string | null) => void;
+  // پروژه‌های تخصیص‌یافته را می‌نشاند و پروژه‌ی فعال را اعتبارسنجی می‌کند:
+  // اگر پروژه‌ی ذخیره‌شده (localStorage) باطل شده باشد، به اولین پروژه برمی‌گردد.
+  setProjects: (projects: { id: string; name: string }[]) => void;
+  // جابه‌جایی پروژه‌ی فعال بدون هیچ تغییری در نشست/توکن (بدون احراز هویت مجدد)
+  setActiveProject: (projectId: string) => void;
   logout: () => void;
 }
 
@@ -53,9 +59,30 @@ export const useAuthStore = create<AuthStore>()(
             role_label: role === "pm" ? "مدیر پروژه (آزمایشی)" : role === "procurement_manager" ? "مدیر تدارکات (آزمایشی)" : "ادمین (آزمایشی)",
             project_id: projectId,
             project_name: projectName,
+            projects: projectId ? [{ id: projectId, name: projectName || "" }] : [],
             display_name: projectId ? `کاربر آزمایشی — ${projectName || ""}` : "کاربر آزمایشی",
           },
         }),
+      setProjects: (projects) =>
+        set((s) => {
+          if (!s.user) return {};
+          const active = projects.find((p) => p.id === s.user!.project_id) ?? projects[0] ?? null;
+          return {
+            user: {
+              ...s.user,
+              projects,
+              project_id: active?.id ?? null,
+              project_name: active?.name ?? null,
+            },
+          };
+        }),
+      setActiveProject: (projectId) =>
+        set((s) => {
+          if (!s.user) return {};
+          const target = (s.user.projects ?? []).find((p) => p.id === projectId);
+          if (!target) return {};
+          return { user: { ...s.user, project_id: target.id, project_name: target.name } };
+        }),
       logout: () => set({ token: null, user: null, isDev: false }),
     }),
     { name: "procurement-auth-v1" },

frontend/src/vite-env.d.ts

@@ -1 +1,10 @@
 /// <reference types="vite/client" />
+
+// Observability build-time configuration (empty = feature disabled)
+interface ImportMetaEnv {
+  readonly VITE_OPENPANEL_URL?: string;
+  readonly VITE_OPENPANEL_CLIENT_ID?: string;
+  readonly VITE_SENTRY_DSN?: string;
+  readonly VITE_ENABLE_DEV_LOGIN?: string;
+  readonly VITE_API_BASE_URL?: string;
+}

infra/deploy-webhook/README.md

@@ -0,0 +1,42 @@
+# Deploy webhook receiver (push-to-deploy, hardened)
+
+Every push to the `production` branch triggers a rebuild on the VPS through
+this receiver (host port 9000). The receiver must **verify the Gitea
+webhook signature** — an open deploy endpoint is effectively remote code
+execution on the production server.
+
+## VPS setup (one time)
+
+```bash
+# 1) Files live here:
+sudo mkdir -p /srv/erp && sudo chown $USER /srv/erp
+#    copy the repo to /srv/erp (the receiver runs docker compose in this dir)
+
+# 2) Secrets — add to /srv/erp/.env (git-ignored):
+#    GITEA_WEBHOOK_SECRET=<long random string>
+
+# 3) Install as a systemd service:
+sudo cp infra/deploy-webhook/erp-deploy-webhook.service /etc/systemd/system/
+#    adjust User= and paths inside, then:
+sudo systemctl daemon-reload
+sudo systemctl enable --now erp-deploy-webhook
+curl http://127.0.0.1:9000/ping   # → {"status":"ok"}
+```
+
+## Gitea webhook
+
+Repo → Settings → Webhooks → Add webhook → Gitea:
+
+- Target URL: `http://<server-ip>:9000/deploy`
+- Method: `POST` — Secret: same value as `GITEA_WEBHOOK_SECRET`
+- Trigger: Push Events, Branch filter: `production`
+
+## Behavior
+
+- Verifies `X-Gitea-Signature` (HMAC-SHA256) — rejects everything else with 401.
+- Only pushes to `refs/heads/production` deploy; other branches are acknowledged and ignored.
+- Deploys are serialized with a lock (concurrent pushes don't race).
+- Runs `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build` in `/srv/erp`.
+- After a successful build, polls the API `/health/ready` endpoint and logs
+  a failed post-deploy check (surfaced by the monitoring stack).
+- Logs to journald (`journalctl -u erp-deploy-webhook -f`).

infra/deploy-webhook/deploy_webhook.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Hardened Gitea push-to-deploy webhook receiver.
+
+Replaces an unverified "POST /deploy" endpoint. Runs on the VPS (host port
+9000 is reserved for it) and rebuilds the stack when a push to the
+production branch arrives — but ONLY after verifying the Gitea webhook
+signature (HMAC-SHA256 of the raw body with GITEA_WEBHOOK_SECRET).
+
+Why this matters: an unauthenticated deploy endpoint lets anyone on the
+internet restart/rebuild the production stack (and, if it shells out to a
+script, is effectively remote code execution).
+
+Setup on the VPS (see infra/deploy-webhook/README.md):
+
+    GITEA_WEBHOOK_SECRET=... DEPLOY_DIR=/srv/erp DEPLOY_BRANCH=production \
+        python3 deploy_webhook.py            # or run under systemd (provided)
+
+Gitea side: repo → Settings → Webhooks → Add webhook → Gitea
+    Target URL: http://<server>:9000/deploy
+    Method: POST, Secret: same value as GITEA_WEBHOOK_SECRET
+    Trigger on: Push Events, Branch filter: production
+
+Stdlib only — no dependencies to install.
+"""
+import hashlib
+import hmac
+import json
+import logging
+import os
+import subprocess
+import sys
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+LISTEN_HOST = os.environ.get("WEBHOOK_LISTEN_HOST", "127.0.0.1")
+LISTEN_PORT = int(os.environ.get("WEBHOOK_PORT", "9000"))
+SECRET = os.environ.get("GITEA_WEBHOOK_SECRET", "")
+DEPLOY_DIR = os.environ.get("DEPLOY_DIR", "/srv/erp")
+DEPLOY_BRANCH = os.environ.get("DEPLOY_BRANCH", "production")
+# Post-deploy readiness gate: defaults to the public API host from .env
+# (both DEPLOY_HEALTH_URL and API_HOST live in the same EnvironmentFile).
+HEALTH_URL = (
+    os.environ.get("DEPLOY_HEALTH_URL")
+    or (f"https://{os.environ['API_HOST']}/health/ready" if os.environ.get("API_HOST") else "")
+)
+LOCK_FILE = os.environ.get("DEPLOY_LOCK", "/tmp/erp-deploy.lock")
+
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s %(levelname)s deploy-webhook — %(message)s",
+    handlers=[logging.StreamHandler(sys.stdout)],
+)
+log = logging.getLogger("deploy-webhook")
+
+# Compose file pair used in production (base + overlay).
+DEPLOY_CMD = os.environ.get(
+    "DEPLOY_CMD",
+    "docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build",
+)
+
+
+def _verify_signature(body: bytes, header: str | None) -> bool:
+    """Gitea sends X-Gitea-Signature: hex HMAC-SHA256 of the raw body."""
+    if not SECRET:
+        log.error("GITEA_WEBHOOK_SECRET is not set — refusing ALL requests")
+        return False
+    if not header:
+        return False
+    expected = hmac.new(SECRET.encode(), body, hashlib.sha256).hexdigest()
+    return hmac.compare_digest(expected, header.strip().lower())
+
+
+def _deploy() -> tuple[bool, str]:
+    """Run the rebuild. Serialized: concurrent pushes queue/drop, not race."""
+    if os.path.exists(LOCK_FILE):
+        age = time.time() - os.path.getmtime(LOCK_FILE)
+        if age < 1800:  # a deploy is already running (or crashed <30min ago)
+            return False, f"deploy already in progress (lock age {int(age)}s)"
+    try:
+        with open(LOCK_FILE, "w") as f:
+            f.write(str(os.getpid()))
+        log.info("deploy started: %s", DEPLOY_CMD)
+        proc = subprocess.run(
+            DEPLOY_CMD, shell=True, cwd=DEPLOY_DIR,
+            capture_output=True, text=True, timeout=1800,
+        )
+        tail = "\n".join((proc.stdout + proc.stderr).splitlines()[-40:])
+        ok = proc.returncode == 0
+        log.info("deploy finished rc=%s\n%s", proc.returncode, tail)
+        if ok and HEALTH_URL:
+            ok = _wait_healthy()
+        return ok, ("ok" if ok else "deploy or health check failed")
+    except subprocess.TimeoutExpired:
+        log.error("deploy timed out after 1800s")
+        return False, "deploy timed out"
+    except Exception as exc:
+        log.exception("deploy failed")
+        return False, str(exc)
+    finally:
+        try:
+            os.remove(LOCK_FILE)
+        except OSError:
+            pass
+
+
+def _wait_healthy(timeout: int = 180) -> bool:
+    """Poll the app's readiness endpoint after a rebuild."""
+    import urllib.request
+    log.info("waiting for %s", HEALTH_URL)
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            with urllib.request.urlopen(HEALTH_URL, timeout=5) as resp:
+                if resp.status == 200:
+                    log.info("post-deploy health check: OK")
+                    return True
+        except Exception:
+            pass
+        time.sleep(5)
+    log.error("post-deploy health check FAILED after %ss", timeout)
+    return False
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        if self.path != "/deploy":
+            self._json(404, {"error": "not found"})
+            return
+        length = int(self.headers.get("Content-Length", "0"))
+        if length > 1_000_000:
+            self._json(413, {"error": "payload too large"})
+            return
+        body = self.rfile.read(length)
+        if not _verify_signature(body, self.headers.get("X-Gitea-Signature")):
+            log.warning("rejected request: bad/missing signature from %s", self.client_address[0])
+            self._json(401, {"error": "invalid signature"})
+            return
+        try:
+            payload = json.loads(body)
+            ref = payload.get("ref", "")
+            pushed = (payload.get("ref") or "").rsplit("/", 1)[-1]
+            if ref != f"refs/heads/{DEPLOY_BRANCH}":
+                log.info("ignoring push to %s (deploys trigger on %s only)", ref, DEPLOY_BRANCH)
+                self._json(200, {"status": "ignored", "ref": ref})
+                return
+            pusher = payload.get("pusher", {}).get("login", "unknown")
+            log.info("push to %s by %s — deploying", pushed, pusher)
+        except Exception:
+            log.exception("bad payload")
+            self._json(400, {"error": "bad payload"})
+            return
+        # Answer the webhook quickly; deploy runs detached from the response.
+        ok, msg = _deploy()
+        self._json(200 if ok else 500, {"status": "ok" if ok else "failed", "detail": msg})
+
+    def do_GET(self):
+        # Minimal liveness for the receiver itself (monitoring can scrape it).
+        if self.path == "/ping":
+            self._json(200, {"status": "ok", "branch": DEPLOY_BRANCH})
+            return
+        self._json(404, {"error": "not found"})
+
+    def _json(self, code: int, obj: dict):
+        data = json.dumps(obj).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def log_message(self, fmt, *args):  # route stdlib access logs to our logger
+        log.debug("access: " + fmt, *args)
+
+
+if __name__ == "__main__":
+    if not SECRET:
+        log.warning("starting WITHOUT signature verification is not supported — set GITEA_WEBHOOK_SECRET")
+        sys.exit(1)
+    server = ThreadingHTTPServer((LISTEN_HOST, LISTEN_PORT), Handler)
+    log.info("listening on %s:%s (branch=%s dir=%s)", LISTEN_HOST, LISTEN_PORT, DEPLOY_BRANCH, DEPLOY_DIR)
+    server.serve_forever()

infra/deploy-webhook/erp-deploy-webhook.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=ERP push-to-deploy webhook receiver (Gitea -> docker compose)
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+# Run as a dedicated non-root user with docker group membership:
+#   sudo useradd -r -s /usr/sbin/nologin erpdeploy && sudo usermod -aG docker erpdeploy
+#   sudo chown -R erpdeploy /srv/erp
+User=erpdeploy
+Group=erpdeploy
+WorkingDirectory=/srv/erp
+# EnvironmentFile carries GITEA_WEBHOOK_SECRET (same .env used by compose).
+EnvironmentFile=/srv/erp/.env
+ExecStart=/usr/bin/python3 /srv/erp/infra/deploy-webhook/deploy_webhook.py
+Restart=on-failure
+RestartSec=5
+# Minimal exposure: no write access outside /srv/erp, no new privileges.
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/srv/erp /tmp
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target

infra/traefik-dynamic.yml

@@ -7,3 +7,31 @@ http:
       redirectScheme:
         scheme: https
         permanent: true
+
+    # Baseline security headers for every public router (attached in the
+    # prod overlay; local http://localhost stays untouched).
+    secure-headers:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        contentTypeNosniff: true
+        referrerPolicy: strict-origin-when-cross-origin
+        customFrameOptionsValue: DENY
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    # Edge rate limiting — coarse abuse brake for the API host
+    # (average 50 req/s sustained, burst 150). Fine-grained login limiting
+    # lives in the app (slowapi).
+    api-ratelimit:
+      rateLimit:
+        average: 50
+        burst: 150
+
+    # Cap request bodies at the edge (attachments are ≤5 MB per file;
+    # 12 MB leaves room for multipart overhead).
+    api-bodylimit:
+      buffering:
+        maxRequestBodyBytes: 12582912

monitoring/README.md

@@ -0,0 +1,124 @@
+# Monitoring & analytics stack
+
+What runs where, and why — the ERP gets the three missing observability
+layers on the same 8 GB VPS:
+
+| Layer | Tool | What it answers | Budget |
+|---|---|---|---|
+| Product analytics | **OpenPanel** (self-hosted) | Which features are used? Where do users drop out of the quote wizard? Funnel: login → wizard steps → quote submitted → accepted → received. Session replay **off** by design (heavy; revisit with sampling later) | ~1–1.5 GB |
+| Error tracking | **GlitchTip** (Sentry-compatible) | What broke, for whom, with which stack trace — frontend (ErrorBoundary + fetch errors) and backend (all unhandled exceptions) | ~750 MB |
+| Metrics + logs | **Prometheus + Grafana + Loki/Promtail + node/postgres-exporters + cAdvisor** | Request rate/latency/5xx, container RAM, Postgres connections, disk pressure; full container logs searchable in Grafana | ~1.4 GB |
+
+The monitoring compose is a **separate compose project** — push-to-deploy
+rebuilds of the app never restart monitoring containers.
+
+## First-time deployment (VPS)
+
+```bash
+cd /srv/erp   # the repo checkout used by the deploy webhook
+
+# 1) monitoring section of .env (see .env.example) — fill in real values:
+#    GLITCHTIP_SECRET_KEY, GLITCHTIP_DOMAIN/HOST, GLITCHTIP_DB_PASSWORD,
+#    GRAFANA_ADMIN_PASSWORD, POSTGRES_PASSWORD (already set), LOG_FORMAT=json
+
+# 2) the main compose gained a shared network — re-up once so it exists:
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+
+# 3) start monitoring:
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+
+# 4) GlitchTip is routed publicly through Traefik for the browser SDK:
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env \
+    --profile public up -d glitchtip
+```
+
+Admin UIs stay **loopback-only** (same posture as the MinIO console):
+
+```powershell
+ssh -L 3001:127.0.0.1:3001 -L 8001:127.0.0.1:8001 <user>@<server-host>
+# Grafana  → http://localhost:3001  (dashboards auto-provisioned)
+# GlitchTip → http://localhost:8001 (create the first admin on first open)
+```
+
+In GlitchTip: create an **organization → project** for the backend and one
+for the frontend, copy the DSNs into `/srv/erp/.env`
+(`SENTRY_DSN_BACKEND`, `SENTRY_DSN_FRONTEND`) and redeploy the app once.
+
+## Product analytics (OpenPanel)
+
+Deployed from the upstream self-hosting branch (kept outside this repo —
+it ships its own compose + update tooling):
+
+```bash
+cd /opt
+git clone -b self-hosting https://github.com/Openpanel-dev/openpanel.git
+cd openpanel/self-hosting
+./setup     # interactive
+./start
+```
+
+Then:
+
+1. Open the OpenPanel dashboard (expose it via Traefik on
+   `stats.bennu-api-bahrestan.ir` following its docs — add the container to
+   `traefik_network` and give the dashboard + its `/api` path labels),
+   create a project → copy the **client id / client secret**.
+2. Put them in `/srv/erp/.env`:
+   `OPENPANEL_API_URL` (in-network URL of its api service),
+   `OPENPANEL_CLIENT_ID`, `OPENPANEL_CLIENT_SECRET`, and
+   `OPENPANEL_PUBLIC_URL` (browser-facing origin) — then rebuild the app:
+   `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build api frontend`.
+
+What gets tracked automatically once configured:
+
+- **Frontend**: page views, `login_success`, `wizard_step` (funnel across
+  the 5 quote-wizard steps), `quote_submitted`, `user_identified`.
+- **Backend** (server-side, cannot be blocked by the browser):
+  `login_success`, `quote_offered/edited/accepted/arrived/expired/rejected`,
+  `receipt_confirmed` — see `backend/app/services/analytics.py`.
+
+Without the env vars everything is a no-op — the app never waits on
+analytics (3 s timeout, swallow-all).
+
+## Session replay
+
+Deliberately **off** (records full DOM of every session → storage + privacy
+costs; low value for a small internal team at launch). If wanted later:
+enable OpenPanel replay with **10–25% sampling** and review retention —
+budget +1 GB storage and re-check RAM headroom first.
+
+## Alerting
+
+`monitoring/prometheus/alerts.yml` defines: API down, 5xx > 5%, p95 > 2 s,
+root disk < 10%, host RAM < 10%, Postgres > 80 connections. They appear in
+Grafana alerting; wire a notification channel (email/Telegram) from the
+Grafana UI when ready.
+
+## Lean mode (if RAM gets tight)
+
+Drop prometheus+grafana+loki+promtail+cadvisor+node-exporter (~1.1 GB) and
+keep GlitchTip + OpenPanel only; add `uptime-kuma` (~100 MB) for
+up/down pings. The app keeps `/health/ready` either way — the deploy
+webhook uses it post-rebuild regardless of the metrics stack.
+
+## What the app exposes for this stack
+
+- `GET /health` — liveness (process up).
+- `GET /health/ready` — readiness: Postgres + MinIO + Casdoor checks.
+  Used by the deploy webhook after every rebuild.
+- `GET /metrics` — Prometheus format (unauthenticated, for scraping).
+- JSON request logs with `X-Request-ID` (set `LOG_FORMAT=json` in prod)
+  → shipped to Loki by Promtail.
+
+## Local runs (Docker Desktop)
+
+Start WITHOUT `--profile host-metrics` — node-exporter and cAdvisor need
+Linux rootfs mounts and will fail to start on Windows/macOS hosts:
+
+```bash
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+```
+
+Per-container and host metrics are absent locally; API metrics, Postgres
+metrics, logs, GlitchTip and Grafana all work the same. On the Linux VPS
+always include `--profile host-metrics`.