From 41fc23b9b26f18000fd1c56f9be3e28739a2f4cc Mon Sep 17 00:00:00 2001 From: Mihir Kandoi Date: Thu, 23 Jul 2026 12:12:49 +0530 Subject: [PATCH] fix: drop Customer's unused level-1 Sales User read grant Makes visibility uniform across the three masters: only the master-manager role can see or edit company restriction fields. --- .../selling/doctype/customer/customer.json | 7 +--- .../test_company_restriction.py | 36 +++++++++++++------ 2 files changed, 26 insertions(+), 17 deletions(-) diff --git a/erpnext/selling/doctype/customer/customer.json b/erpnext/selling/doctype/customer/customer.json index a37a94cb850..24aeebf7544 100644 --- a/erpnext/selling/doctype/customer/customer.json +++ b/erpnext/selling/doctype/customer/customer.json @@ -727,7 +727,7 @@ "link_fieldname": "party" } ], - "modified": "2026-07-23 10:00:00.000000", + "modified": "2026-07-23 12:00:00.000000", "modified_by": "Administrator", "module": "Selling", "name": "Customer", @@ -744,11 +744,6 @@ "share": 1, "write": 1 }, - { - "permlevel": 1, - "read": 1, - "role": "Sales User" - }, { "email": 1, "print": 1, diff --git a/erpnext/stock/doctype/company_restriction/test_company_restriction.py b/erpnext/stock/doctype/company_restriction/test_company_restriction.py index 6bfed075be9..719860c1f0b 100644 --- a/erpnext/stock/doctype/company_restriction/test_company_restriction.py +++ b/erpnext/stock/doctype/company_restriction/test_company_restriction.py @@ -80,22 +80,36 @@ class TestCompanyRestriction(ERPNextTestSuite): stock_entry.reload() stock_entry.cancel() + def make_user_with_roles(self, email, roles): + if not frappe.db.exists("User", email): + frappe.get_doc( + { + "doctype": "User", + "email": email, + "first_name": email.split("@")[0], + "roles": [{"role": role} for role in roles], + } + ).insert(ignore_permissions=True) + return email + def test_restriction_fields_require_permlevel_access(self): customer = make_customer("_Test Permlevel Restricted Customer") self.restrict_to_companies("Customer", customer, ["_Test Company"]) - user = "test_company_restriction_perm@example.com" - if not frappe.db.exists("User", user): - frappe.get_doc( - { - "doctype": "User", - "email": user, - "first_name": "Company Restriction Perm", - "roles": [{"role": "Sales User"}], - } - ).insert(ignore_permissions=True) + sales_user = self.make_user_with_roles("test_company_restriction_sales@example.com", ["Sales User"]) + manager = self.make_user_with_roles( + "test_company_restriction_manager@example.com", ["Sales User", "Sales Master Manager"] + ) - frappe.set_user(user) + permitted = frappe.get_meta("Customer").get_permitted_fieldnames(user=sales_user) + self.assertNotIn("restrict_to_companies", permitted) + self.assertNotIn("allowed_companies", permitted) + + permitted = frappe.get_meta("Customer").get_permitted_fieldnames(user=manager) + self.assertIn("restrict_to_companies", permitted) + self.assertIn("allowed_companies", permitted) + + frappe.set_user(sales_user) self.addCleanup(frappe.set_user, "Administrator") doc = frappe.get_doc("Customer", customer)