nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-09-14 09:23:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #55696 from kaulith/fix/ar-report-user-permissions-v16

Browse Source 
fix: apply user permissions to receivable/payable reports
This commit is contained in:
ruthra kumar
2026-06-11 12:27:45 +05:30
committed by GitHub
parent 9c987724d5 4200d17c9b
commit 75ee0ca2d2
2 changed files with 61 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
erpnext/accounts/report/accounts_receivable/accounts_receivable.py
View File

@@ -928,8 +928,28 @@ class ReceivablePayableReport:
if self.filters.project: if self.filters.project:
self.qb_selection_filter.append(self.ple.project.isin(self.filters.project)) self.qb_selection_filter.append(self.ple.project.isin(self.filters.project))
self.add_user_permission_filters()
self.add_accounting_dimensions_filters() self.add_accounting_dimensions_filters()
def add_user_permission_filters(self):
# Party is a dynamic link, so match conditions cannot auto-apply Customer/Supplier user permissions
from frappe.core.doctype.user_permission.user_permission import get_user_permissions
from frappe.permissions import get_allowed_docs_for_doctype
user_permissions = get_user_permissions()
if not user_permissions:
return
for party_type in self.party_type:
if party_type not in user_permissions:
continue
allowed_parties = get_allowed_docs_for_doctype(user_permissions[party_type], party_type)
self.qb_selection_filter.append(
(self.ple.party_type != party_type) | self.ple.party.isin(allowed_parties or [""])
)
def get_cost_center_conditions(self): def get_cost_center_conditions(self):
cost_center_list = get_cost_centers_with_children(self.filters.cost_center) cost_center_list = get_cost_centers_with_children(self.filters.cost_center)
self.qb_selection_filter.append(self.ple.cost_center.isin(cost_center_list)) self.qb_selection_filter.append(self.ple.cost_center.isin(cost_center_list))

41
erpnext/accounts/report/accounts_receivable/test_accounts_receivable.py
View File

@@ -1245,3 +1245,44 @@ class TestAccountsReceivable(ERPNextTestSuite, AccountsTestMixin):
self.assertEqual(len(report[1]), 1) self.assertEqual(len(report[1]), 1)
row = report[1][0] row = report[1][0]
self.assertEqual([si.name, project.name, 60], [row.voucher_no, row.project, row.outstanding]) self.assertEqual([si.name, project.name, 60], [row.voucher_no, row.project, row.outstanding])
def test_accounts_receivable_respects_user_permissions(self):
# Party is a dynamic link on Payment Ledger Entry, so user permissions on Customer
# must be applied explicitly. The report should only show permitted customers.
original_customer = self.customer
second_customer = "_Test AR Perm Customer"
# create_customer overrides self.customer, so build the restricted invoice first
self.create_customer(customer_name=second_customer)
self.create_sales_invoice(no_payment_schedule=True)
self.customer = original_customer
allowed_invoice = self.create_sales_invoice(no_payment_schedule=True)
test_user = "test_ar_user_permission@example.com"
if not frappe.db.exists("User", test_user):
user = frappe.new_doc("User")
user.email = test_user
user.first_name = "AR Perm"
user.append("roles", {"role": "Accounts User"})
user.save()
frappe.permissions.add_user_permission("Customer", original_customer, test_user)
filters = {
"company": self.company,
"party_type": "Customer",
"report_date": today(),
"range": "30, 60, 90, 120",
}
frappe.set_user(test_user)
try:
report = execute(filters)
finally:
frappe.set_user("Administrator")
parties = {row.party for row in report[1]}
self.assertIn(original_customer, parties)
self.assertNotIn(second_customer, parties)
self.assertEqual(allowed_invoice.customer, original_customer)