From a8b6bcacc57ff1258922e4b1d3eb037828c452fa Mon Sep 17 00:00:00 2001 From: Bibin <17405044+bibinqcs@users.noreply.github.com> Date: Sun, 21 Jun 2026 16:43:13 +0000 Subject: [PATCH] fix(FTA Audit File): block regeneration from Generated state The JS button only renders the Generate/Retry action for Draft and Error; the REST endpoint, however, still let an authenticated caller silently overwrite the attached CSV on a Generated FAF. Tighten the server-side guard to match the UI lifecycle so the destructive action has to be explicit (delete and create a new doc to regenerate). --- erpnext/regional/doctype/fta_audit_file/fta_audit_file.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/erpnext/regional/doctype/fta_audit_file/fta_audit_file.py b/erpnext/regional/doctype/fta_audit_file/fta_audit_file.py index e228b67d00f..e0bcf2b1635 100644 --- a/erpnext/regional/doctype/fta_audit_file/fta_audit_file.py +++ b/erpnext/regional/doctype/fta_audit_file/fta_audit_file.py @@ -121,8 +121,11 @@ class FTAAuditFile(Document): current_status = frappe.db.get_value(self.doctype, self.name, "status", for_update=True) if current_status in IN_FLIGHT_STATUSES: frappe.throw(_("FAF generation is already {0} for this document.").format(current_status)) - if current_status == "Submitted": - frappe.throw(_("Cannot regenerate a Submitted FAF.")) + if current_status in ("Generated", "Submitted"): + # UI hides the Generate/Retry button for Generated and Submitted; + # enforce the same lifecycle on the REST endpoint so a direct + # call cannot silently overwrite the attached CSV. + frappe.throw(_("FAF is already {0}; create a new document to regenerate.").format(current_status)) self.status = "Queued" self.generation_log = ""