From 0fea93388d70106071672fa76c89ac98b2f51773 Mon Sep 17 00:00:00 2001 From: Rohit Waghchaure Date: Fri, 12 Jun 2026 13:01:44 +0530 Subject: [PATCH 1/3] fix: permissions in workstation file (cherry picked from commit cf127e89005fd45038870bac95feb7009e95f45f) # Conflicts: # erpnext/manufacturing/doctype/workstation/workstation.py --- .../doctype/workstation/workstation.py | 31 ++++++++++++++----- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/erpnext/manufacturing/doctype/workstation/workstation.py b/erpnext/manufacturing/doctype/workstation/workstation.py index eee5b5c0638..06aabd5bb0c 100644 --- a/erpnext/manufacturing/doctype/workstation/workstation.py +++ b/erpnext/manufacturing/doctype/workstation/workstation.py @@ -83,7 +83,7 @@ class Workstation(Document): def before_save(self): if self.has_value_changed("workstation_type"): - self.set_data_based_on_workstation_type() + self._set_data_based_on_workstation_type() self.set_hour_rate() self.set_total_working_hours() @@ -114,6 +114,10 @@ class Workstation(Document): @frappe.whitelist() def set_data_based_on_workstation_type(self): + self.check_permission("write") + self._set_data_based_on_workstation_type() + + def _set_data_based_on_workstation_type(self): if self.workstation_type: data = frappe.get_all( "Workstation Cost", @@ -211,6 +215,8 @@ class Workstation(Document): @frappe.whitelist() def start_job(self, job_card, from_time, employee): doc = frappe.get_doc("Job Card", job_card) + doc.check_permission("write") + doc.append("time_logs", {"from_time": from_time, "employee": employee}) doc.save(ignore_permissions=True) @@ -219,6 +225,8 @@ class Workstation(Document): @frappe.whitelist() def complete_job(self, job_card, qty, to_time): doc = frappe.get_doc("Job Card", job_card) + doc.check_permission("submit") + for row in doc.time_logs: if not row.to_time: row.to_time = to_time @@ -316,7 +324,13 @@ def get_status_color(status): @frappe.whitelist() +<<<<<<< HEAD def get_raw_materials(job_card): +======= +def get_raw_materials(job_card: str): + frappe.has_permission("Job Card", "read", doc=job_card, throw=True) + +>>>>>>> cf127e8900 (fix: permissions in workstation file) raw_materials = frappe.get_all( "Job Card", fields=[ @@ -460,6 +474,8 @@ def check_workstation_for_holiday(workstation, from_datetime, to_datetime): @frappe.whitelist() def get_workstations(**kwargs): + frappe.has_permission("Workstation", "read", throw=True) + kwargs = frappe._dict(kwargs) _workstation = frappe.qb.DocType("Workstation") @@ -535,13 +551,8 @@ def update_job_card(job_card: str, method: str, **kwargs): title=_("Not Allowed"), ) - frappe.has_permission("Job Card", "read", throw=True) - doc = frappe.get_doc("Job Card", job_card) - - # These methods mutate the Job Card, but frappe.get_doc does not enforce permissions — - # require write access before running anything. - frappe.has_permission("Job Card", "write", doc=doc, throw=True) + doc.check_permission("write") if isinstance(kwargs, dict): kwargs = frappe._dict(kwargs) @@ -556,7 +567,13 @@ def update_job_card(job_card: str, method: str, **kwargs): @frappe.whitelist() +<<<<<<< HEAD def validate_job_card(job_card, status): +======= +def validate_job_card(job_card: str, status: str): + frappe.has_permission("Job Card", "read", doc=job_card, throw=True) + +>>>>>>> cf127e8900 (fix: permissions in workstation file) job_card_details = frappe.db.get_value("Job Card", job_card, ["status", "for_quantity"], as_dict=1) current_status = job_card_details.status From d04965b6b25e4f6079ca37270948a1639e69b1eb Mon Sep 17 00:00:00 2001 From: rohitwaghchaure Date: Fri, 12 Jun 2026 16:51:57 +0530 Subject: [PATCH 2/3] chore: fix conflicts --- erpnext/manufacturing/doctype/workstation/workstation.py | 8 -------- 1 file changed, 8 deletions(-) diff --git a/erpnext/manufacturing/doctype/workstation/workstation.py b/erpnext/manufacturing/doctype/workstation/workstation.py index 06aabd5bb0c..d2f908bddc8 100644 --- a/erpnext/manufacturing/doctype/workstation/workstation.py +++ b/erpnext/manufacturing/doctype/workstation/workstation.py @@ -324,13 +324,9 @@ def get_status_color(status): @frappe.whitelist() -<<<<<<< HEAD -def get_raw_materials(job_card): -======= def get_raw_materials(job_card: str): frappe.has_permission("Job Card", "read", doc=job_card, throw=True) ->>>>>>> cf127e8900 (fix: permissions in workstation file) raw_materials = frappe.get_all( "Job Card", fields=[ @@ -567,13 +563,9 @@ def update_job_card(job_card: str, method: str, **kwargs): @frappe.whitelist() -<<<<<<< HEAD -def validate_job_card(job_card, status): -======= def validate_job_card(job_card: str, status: str): frappe.has_permission("Job Card", "read", doc=job_card, throw=True) ->>>>>>> cf127e8900 (fix: permissions in workstation file) job_card_details = frappe.db.get_value("Job Card", job_card, ["status", "for_quantity"], as_dict=1) current_status = job_card_details.status From 11c7a35eaeda7e110817e4eeb71796a8fbe61145 Mon Sep 17 00:00:00 2001 From: rohitwaghchaure Date: Fri, 12 Jun 2026 17:17:03 +0530 Subject: [PATCH 3/3] chore: fix linters issue --- erpnext/manufacturing/doctype/workstation/workstation.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/erpnext/manufacturing/doctype/workstation/workstation.py b/erpnext/manufacturing/doctype/workstation/workstation.py index d2f908bddc8..8d54667ea50 100644 --- a/erpnext/manufacturing/doctype/workstation/workstation.py +++ b/erpnext/manufacturing/doctype/workstation/workstation.py @@ -19,6 +19,7 @@ from frappe.utils import ( time_diff_in_seconds, to_timedelta, ) +from frappe.utils.data import DateTimeLikeObject from erpnext.support.doctype.issue.issue import get_holidays @@ -213,7 +214,7 @@ class Workstation(Document): return schedule_date @frappe.whitelist() - def start_job(self, job_card, from_time, employee): + def start_job(self, job_card: str, from_time: DateTimeLikeObject, employee: str): doc = frappe.get_doc("Job Card", job_card) doc.check_permission("write") @@ -223,7 +224,7 @@ class Workstation(Document): return doc @frappe.whitelist() - def complete_job(self, job_card, qty, to_time): + def complete_job(self, job_card: str, qty: float, to_time: DateTimeLikeObject): doc = frappe.get_doc("Job Card", job_card) doc.check_permission("submit")