From 1e2894a4836a597b74fb122f1eb18178684394fd Mon Sep 17 00:00:00 2001
From: Diptanil Saha <diptanil@frappe.io>
Date: Thu, 27 Aug 2026 22:06:36 +0530
Subject: [PATCH] fix(accounts): set pos profile on invoices respecting user
 permissions (#58508)

(cherry picked from commit 90185731790fc1899492363f5ad3e84d01050edb)

# Conflicts:
#	erpnext/accounts/doctype/pos_profile/pos_profile.py
---
 .../doctype/pos_profile/pos_profile.py        | 37 +++++++++++++++++++
 erpnext/stock/get_item_details.py             |  7 ++++
 2 files changed, 44 insertions(+)

diff --git a/erpnext/accounts/doctype/pos_profile/pos_profile.py b/erpnext/accounts/doctype/pos_profile/pos_profile.py
index 5edaa2b89c3..96c5995942e 100644
--- a/erpnext/accounts/doctype/pos_profile/pos_profile.py
+++ b/erpnext/accounts/doctype/pos_profile/pos_profile.py
@@ -271,6 +271,7 @@ def pos_profile_query(doctype, txt, searchfield, start, page_len, filters):
 	user = frappe.session["user"]
 	company = filters.get("company") or frappe.defaults.get_user_default("company")
 
+<<<<<<< HEAD
 	args = {
 		"user": user,
 		"start": start,
@@ -305,6 +306,42 @@ def pos_profile_query(doctype, txt, searchfield, start, page_len, filters):
 				and pf.name like %(txt)s
 				and pf.disabled = 0""",
 			args,
+=======
+	allowed_pos_profiles = frappe.get_list("POS Profile", pluck="name")
+
+	if not allowed_pos_profiles:
+		return {}
+
+	pf = frappe.qb.DocType("POS Profile")
+	pfu = frappe.qb.DocType("POS Profile User")
+
+	pos_profile = (
+		frappe.qb.from_(pf)
+		.inner_join(pfu)
+		.on(pfu.parent == pf.name)
+		.select(pf.name)
+		.where((pfu.user == user) & (pf.company == company) & pf.name.like(f"%{txt}%") & (pf.disabled == 0))
+		.where(pf.name.isin(allowed_pos_profiles))
+		.limit(page_len)
+		.offset(start)
+		.run()
+	)
+
+	if not pos_profile:
+		pos_profile = (
+			frappe.qb.from_(pf)
+			.left_join(pfu)
+			.on(pf.name == pfu.parent)
+			.select(pf.name)
+			.where(
+				(pfu.user.isnull() | (pfu.user == ""))
+				& (pf.company == company)
+				& pf.name.like(f"%{txt}%")
+				& (pf.disabled == 0)
+				& (pf.name.isin(allowed_pos_profiles))
+			)
+			.run()
+>>>>>>> 9018573 (fix(accounts): set pos profile on invoices respecting user permissions (#58508))
 		)
 
 	return pos_profile
diff --git a/erpnext/stock/get_item_details.py b/erpnext/stock/get_item_details.py
index 6c1d658481a..b68cbc08174 100644
--- a/erpnext/stock/get_item_details.py
+++ b/erpnext/stock/get_item_details.py
@@ -1418,6 +1418,11 @@ def get_pos_profile(company, pos_profile=None, user=None):
 	if not user:
 		user = frappe.session["user"]
 
+	allowed_pos_profiles = frappe.get_list("POS Profile", pluck="name")
+
+	if not allowed_pos_profiles:
+		return None
+
 	pf = frappe.qb.DocType("POS Profile")
 	pfu = frappe.qb.DocType("POS Profile User")
 
@@ -1427,6 +1432,7 @@ def get_pos_profile(company, pos_profile=None, user=None):
 		.on(pf.name == pfu.parent)
 		.select(pf.star)
 		.where((pfu.user == user) & (pfu.default == 1))
+		.where(pf.name.isin(allowed_pos_profiles))
 	)
 
 	if company:
@@ -1441,6 +1447,7 @@ def get_pos_profile(company, pos_profile=None, user=None):
 			.on(pf.name == pfu.parent)
 			.select(pf.star)
 			.where((pf.company == company) & (pf.disabled == 0))
+			.where(pf.name.isin(allowed_pos_profiles))
 		).run(as_dict=True)
 
 	return pos_profile and pos_profile[0] or None