Merge pull request #57383 from mihir-kandoi/company-restriction-permlevel

fix: gate company restriction fields behind permlevel 1

erpnext/buying/doctype/supplier/supplier.json

@@ -431,14 +431,16 @@
   {
    "fieldname": "company_restrictions_section",
    "fieldtype": "Section Break",
-   "label": "Company Restrictions"
+   "label": "Company Restrictions",
+   "permlevel": 1
   },
   {
    "default": "0",
    "fieldname": "restrict_to_companies",
    "fieldtype": "Check",
    "label": "Restrict to Companies",
-   "description": "If checked, this Supplier is only available for transactions in the companies listed below."
+   "description": "If checked, this Supplier is only available for transactions in the companies listed below.",
+   "permlevel": 1
   },
   {
    "fieldname": "allowed_companies",
@@ -446,7 +448,8 @@
    "label": "Allowed Companies",
    "options": "Company Restriction",
    "depends_on": "eval:doc.restrict_to_companies",
-   "mandatory_depends_on": "eval:doc.restrict_to_companies"
+   "mandatory_depends_on": "eval:doc.restrict_to_companies",
+   "permlevel": 1
   },
   {
    "fieldname": "contact_and_address_tab",
@@ -585,7 +588,7 @@
    "link_fieldname": "party"
   }
  ],
- "modified": "2026-07-14 23:00:00.000000",
+ "modified": "2026-07-23 10:00:00.000000",
  "modified_by": "Administrator",
  "module": "Buying",
  "name": "Supplier",
@@ -641,6 +644,12 @@
    "read": 1,
    "report": 1,
    "role": "Accounts Manager"
+  },
+  {
+   "permlevel": 1,
+   "read": 1,
+   "role": "Purchase Master Manager",
+   "write": 1
   }
  ],
  "quick_entry": 1,

erpnext/selling/doctype/customer/customer.json

@@ -519,14 +519,16 @@
   {
    "fieldname": "company_restrictions_section",
    "fieldtype": "Section Break",
-   "label": "Company Restrictions"
+   "label": "Company Restrictions",
+   "permlevel": 1
   },
   {
    "default": "0",
    "fieldname": "restrict_to_companies",
    "fieldtype": "Check",
    "label": "Restrict to Companies",
-   "description": "If checked, this Customer is only available for transactions in the companies listed below."
+   "description": "If checked, this Customer is only available for transactions in the companies listed below.",
+   "permlevel": 1
   },
   {
    "fieldname": "allowed_companies",
@@ -534,7 +536,8 @@
    "label": "Allowed Companies",
    "options": "Company Restriction",
    "depends_on": "eval:doc.restrict_to_companies",
-   "mandatory_depends_on": "eval:doc.restrict_to_companies"
+   "mandatory_depends_on": "eval:doc.restrict_to_companies",
+   "permlevel": 1
   },
   {
    "collapsible": 1,
@@ -724,7 +727,7 @@
    "link_fieldname": "party"
   }
  ],
- "modified": "2026-07-14 23:00:00.000000",
+ "modified": "2026-07-23 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Selling",
  "name": "Customer",
@@ -741,11 +744,6 @@
    "share": 1,
    "write": 1
   },
-  {
-   "permlevel": 1,
-   "read": 1,
-   "role": "Sales User"
-  },
   {
    "email": 1,
    "print": 1,

erpnext/stock/doctype/company_restriction/test_company_restriction.py

@@ -79,3 +79,42 @@ class TestCompanyRestriction(ERPNextTestSuite):
 		self.restrict_to_companies("Item", item.name, ["_Test Company 1"])
 		stock_entry.reload()
 		stock_entry.cancel()
+
+	def make_user_with_roles(self, email, roles):
+		if not frappe.db.exists("User", email):
+			frappe.get_doc(
+				{
+					"doctype": "User",
+					"email": email,
+					"first_name": email.split("@")[0],
+					"roles": [{"role": role} for role in roles],
+				}
+			).insert(ignore_permissions=True)
+		return email
+
+	def test_restriction_fields_require_permlevel_access(self):
+		customer = make_customer("_Test Permlevel Restricted Customer")
+		self.restrict_to_companies("Customer", customer, ["_Test Company"])
+
+		sales_user = self.make_user_with_roles("test_company_restriction_sales@example.com", ["Sales User"])
+		manager = self.make_user_with_roles(
+			"test_company_restriction_manager@example.com", ["Sales User", "Sales Master Manager"]
+		)
+
+		permitted = frappe.get_meta("Customer").get_permitted_fieldnames(user=sales_user)
+		self.assertNotIn("restrict_to_companies", permitted)
+
+		permitted = frappe.get_meta("Customer").get_permitted_fieldnames(user=manager)
+		self.assertIn("restrict_to_companies", permitted)
+
+		frappe.set_user(sales_user)
+		self.addCleanup(frappe.set_user, "Administrator")
+
+		doc = frappe.get_doc("Customer", customer)
+		doc.restrict_to_companies = 0
+		doc.set("allowed_companies", [])
+		doc.save()
+
+		doc.reload()
+		self.assertEqual(doc.restrict_to_companies, 1)
+		self.assertEqual([row.company for row in doc.allowed_companies], ["_Test Company"])

erpnext/stock/doctype/item/item.json

@@ -1090,14 +1090,16 @@
   {
    "fieldname": "company_restrictions_section",
    "fieldtype": "Section Break",
-   "label": "Company Restrictions"
+   "label": "Company Restrictions",
+   "permlevel": 1
   },
   {
    "default": "0",
    "fieldname": "restrict_to_companies",
    "fieldtype": "Check",
    "label": "Restrict to Companies",
-   "description": "If checked, this Item is only available for transactions in the companies listed below."
+   "description": "If checked, this Item is only available for transactions in the companies listed below.",
+   "permlevel": 1
   },
   {
    "fieldname": "allowed_companies",
@@ -1105,7 +1107,8 @@
    "label": "Allowed Companies",
    "options": "Company Restriction",
    "depends_on": "eval:doc.restrict_to_companies",
-   "mandatory_depends_on": "eval:doc.restrict_to_companies"
+   "mandatory_depends_on": "eval:doc.restrict_to_companies",
+   "permlevel": 1
   }
  ],
  "icon": "fa fa-tag",
@@ -1113,7 +1116,7 @@
  "image_field": "image",
  "links": [],
  "make_attachments_public": 1,
- "modified": "2026-07-14 23:00:00.000000",
+ "modified": "2026-07-23 10:00:00.000000",
  "modified_by": "Administrator",
  "module": "Stock",
  "name": "Item",
@@ -1175,6 +1178,12 @@
    "role": "Desk User",
    "select": 1,
    "share": 1
+  },
+  {
+   "permlevel": 1,
+   "read": 1,
+   "role": "Item Manager",
+   "write": 1
   }
  ],
  "quick_entry": 1,