fix(accounts): add permission checks on invoice_discounting.get_invoices (backport #58975) (#58989)

Co-authored-by: Diptanil Saha <diptanil@frappe.io>

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.js

@@ -136,6 +136,7 @@ frappe.ui.form.on("Invoice Discounting", {
 			],
 			primary_action: function () {
 				var data = d.get_values();
+				data.company = frm.doc.company;
 
 				frappe.call({
 					method: "erpnext.accounts.doctype.invoice_discounting.invoice_discounting.get_invoices",

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json

@@ -168,7 +168,7 @@
   }
  ],
  "is_submittable": 1,
- "modified": "2019-05-30 19:08:21.199759",
+ "modified": "2026-09-09 17:04:59.512294",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Invoice Discounting",
@@ -185,7 +185,7 @@
    "print": 1,
    "read": 1,
    "report": 1,
-   "role": "System Manager",
+   "role": "Accounts Manager",
    "share": 1,
    "submit": 1,
    "write": 1
@@ -194,4 +194,4 @@
  "sort_field": "modified",
  "sort_order": "DESC",
  "track_changes": 1
-}
+}

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.py

@@ -319,6 +319,13 @@ class InvoiceDiscounting(AccountsController):
 @frappe.whitelist()
 def get_invoices(filters):
 	filters = frappe._dict(json.loads(filters))
+
+	if not filters.get("company"):
+		frappe.throw(_("Please set company on the Document before requesting for invoices."))
+
+	frappe.has_permission("Company", doc=filters.get("company"), throw=True)
+	frappe.has_permission("Invoice Discounting", throw=True)
+
 	cond = []
 	if filters.customer:
 		cond.append("customer=%(customer)s")