fix: gate company restriction fields behind permlevel 1

Only the master-manager role of each doctype (Item Manager, Sales Master
Manager, Purchase Master Manager) can view and edit restrict_to_companies
and allowed_companies. Customer reuses its existing level-1 permission
rows; Item and Supplier get a new level-1 row.

erpnext/buying/doctype/supplier/supplier.json

@@ -431,14 +431,16 @@
   {
    "fieldname": "company_restrictions_section",
    "fieldtype": "Section Break",
-   "label": "Company Restrictions"
+   "label": "Company Restrictions",
+   "permlevel": 1
   },
   {
    "default": "0",
    "fieldname": "restrict_to_companies",
    "fieldtype": "Check",
    "label": "Restrict to Companies",
-   "description": "If checked, this Supplier is only available for transactions in the companies listed below."
+   "description": "If checked, this Supplier is only available for transactions in the companies listed below.",
+   "permlevel": 1
   },
   {
    "fieldname": "allowed_companies",
@@ -446,7 +448,8 @@
    "label": "Allowed Companies",
    "options": "Company Restriction",
    "depends_on": "eval:doc.restrict_to_companies",
-   "mandatory_depends_on": "eval:doc.restrict_to_companies"
+   "mandatory_depends_on": "eval:doc.restrict_to_companies",
+   "permlevel": 1
   },
   {
    "fieldname": "contact_and_address_tab",
@@ -585,7 +588,7 @@
    "link_fieldname": "party"
   }
  ],
- "modified": "2026-07-14 23:00:00.000000",
+ "modified": "2026-07-23 10:00:00.000000",
  "modified_by": "Administrator",
  "module": "Buying",
  "name": "Supplier",
@@ -641,6 +644,12 @@
    "read": 1,
    "report": 1,
    "role": "Accounts Manager"
+  },
+  {
+   "permlevel": 1,
+   "read": 1,
+   "role": "Purchase Master Manager",
+   "write": 1
   }
  ],
  "quick_entry": 1,

erpnext/selling/doctype/customer/customer.json

@@ -519,14 +519,16 @@
   {
    "fieldname": "company_restrictions_section",
    "fieldtype": "Section Break",
-   "label": "Company Restrictions"
+   "label": "Company Restrictions",
+   "permlevel": 1
   },
   {
    "default": "0",
    "fieldname": "restrict_to_companies",
    "fieldtype": "Check",
    "label": "Restrict to Companies",
-   "description": "If checked, this Customer is only available for transactions in the companies listed below."
+   "description": "If checked, this Customer is only available for transactions in the companies listed below.",
+   "permlevel": 1
   },
   {
    "fieldname": "allowed_companies",
@@ -534,7 +536,8 @@
    "label": "Allowed Companies",
    "options": "Company Restriction",
    "depends_on": "eval:doc.restrict_to_companies",
-   "mandatory_depends_on": "eval:doc.restrict_to_companies"
+   "mandatory_depends_on": "eval:doc.restrict_to_companies",
+   "permlevel": 1
   },
   {
    "collapsible": 1,
@@ -724,7 +727,7 @@
    "link_fieldname": "party"
   }
  ],
- "modified": "2026-07-14 23:00:00.000000",
+ "modified": "2026-07-23 10:00:00.000000",
  "modified_by": "Administrator",
  "module": "Selling",
  "name": "Customer",

erpnext/stock/doctype/company_restriction/test_company_restriction.py

@@ -79,3 +79,30 @@ class TestCompanyRestriction(ERPNextTestSuite):
 		self.restrict_to_companies("Item", item.name, ["_Test Company 1"])
 		stock_entry.reload()
 		stock_entry.cancel()
+
+	def test_restriction_fields_require_permlevel_access(self):
+		customer = make_customer("_Test Permlevel Restricted Customer")
+		self.restrict_to_companies("Customer", customer, ["_Test Company"])
+
+		user = "test_company_restriction_perm@example.com"
+		if not frappe.db.exists("User", user):
+			frappe.get_doc(
+				{
+					"doctype": "User",
+					"email": user,
+					"first_name": "Company Restriction Perm",
+					"roles": [{"role": "Sales User"}],
+				}
+			).insert(ignore_permissions=True)
+
+		frappe.set_user(user)
+		self.addCleanup(frappe.set_user, "Administrator")
+
+		doc = frappe.get_doc("Customer", customer)
+		doc.restrict_to_companies = 0
+		doc.set("allowed_companies", [])
+		doc.save()
+
+		doc.reload()
+		self.assertEqual(doc.restrict_to_companies, 1)
+		self.assertEqual([row.company for row in doc.allowed_companies], ["_Test Company"])

erpnext/stock/doctype/item/item.json

@@ -1090,14 +1090,16 @@
   {
    "fieldname": "company_restrictions_section",
    "fieldtype": "Section Break",
-   "label": "Company Restrictions"
+   "label": "Company Restrictions",
+   "permlevel": 1
   },
   {
    "default": "0",
    "fieldname": "restrict_to_companies",
    "fieldtype": "Check",
    "label": "Restrict to Companies",
-   "description": "If checked, this Item is only available for transactions in the companies listed below."
+   "description": "If checked, this Item is only available for transactions in the companies listed below.",
+   "permlevel": 1
   },
   {
    "fieldname": "allowed_companies",
@@ -1105,7 +1107,8 @@
    "label": "Allowed Companies",
    "options": "Company Restriction",
    "depends_on": "eval:doc.restrict_to_companies",
-   "mandatory_depends_on": "eval:doc.restrict_to_companies"
+   "mandatory_depends_on": "eval:doc.restrict_to_companies",
+   "permlevel": 1
   }
  ],
  "icon": "fa fa-tag",
@@ -1113,7 +1116,7 @@
  "image_field": "image",
  "links": [],
  "make_attachments_public": 1,
- "modified": "2026-07-14 23:00:00.000000",
+ "modified": "2026-07-23 10:00:00.000000",
  "modified_by": "Administrator",
  "module": "Stock",
  "name": "Item",
@@ -1175,6 +1178,12 @@
    "role": "Desk User",
    "select": 1,
    "share": 1
+  },
+  {
+   "permlevel": 1,
+   "read": 1,
+   "role": "Item Manager",
+   "write": 1
   }
  ],
  "quick_entry": 1,