chore(release): Bumped to Version 16.36.0

# [16.36.0](https://github.com/frappe/erpnext/compare/v16.35.0...v16.36.0) (2026-09-23)

### Bug Fixes

* **accounts:** clarify revaluation journal filters ([eebd0bc](eebd0bc533))
* **accounts:** keep price list within user permissions ([#59231](https://github.com/frappe/erpnext/issues/59231)) ([385343a](385343a389))
* apply journal entry reversal backport to version 16 controller ([0db0cc5](0db0cc55d4))
* **assets:** count complete opening depreciation periods accurately ([900eb1e](900eb1e466))
* **asset:** skip missing checkbox columns in asset type patch (backport [#58416](https://github.com/frappe/erpnext/issues/58416)) ([#58417](https://github.com/frappe/erpnext/issues/58417)) ([3c9d9d6](3c9d9d62aa))
* avoid pricing rule help template errors ([#59097](https://github.com/frappe/erpnext/issues/59097)) ([e3ef3be](e3ef3be490))
* clear stock value for zero-quantity balances ([#58899](https://github.com/frappe/erpnext/issues/58899)) ([007a1f5](007a1f5528))
* **crm:** keep opportunity type default untranslated ([#59277](https://github.com/frappe/erpnext/issues/59277)) ([8eb9063](8eb906366d))
* do not zero out backdated stock at a stock reco adjustment entry ([#59270](https://github.com/frappe/erpnext/issues/59270)) ([06a8faa](06a8faa4ed))
* **journal-entry:** carry reference fields into reverse journal entry ([06cc291](06cc2914ba))
* **manufacturing:** apply mrp manufacturing buffer as a duration ([#59007](https://github.com/frappe/erpnext/issues/59007)) ([fa732ca](fa732ca3f4))
* **manufacturing:** classify MRP rows by purchase item, not missing BOM ([#58510](https://github.com/frappe/erpnext/issues/58510)) ([79858d5](79858d5af6))
* **manufacturing:** finish a work order after partial material consumption ([#59312](https://github.com/frappe/erpnext/issues/59312)) ([5d495c2](5d495c2763))
* **manufacturing:** include the mrp bucket that ends on to_date ([#59143](https://github.com/frappe/erpnext/issues/59143)) ([131343d](131343de28))
* negative stock value for moving average item with mixed batchwise valuation ([#59099](https://github.com/frappe/erpnext/issues/59099)) ([262fdf3](262fdf3e69))
* **permissions:** grant select on link targets to roles with write access ([#59123](https://github.com/frappe/erpnext/issues/59123)) ([854b0e4](854b0e4734))
* **pos:** quote the reversed row's rate on a consolidated credit note (backport [#59320](https://github.com/frappe/erpnext/issues/59320)) ([#59323](https://github.com/frappe/erpnext/issues/59323)) ([242f421](242f4219cb))
* **pos:** reset stale selected mode of payment on new invoice (backport [#59308](https://github.com/frappe/erpnext/issues/59308)) ([#59355](https://github.com/frappe/erpnext/issues/59355)) ([1e16c82](1e16c827ef))
* **quality:** block Quality Inspection submit without a sample size (backport [#59330](https://github.com/frappe/erpnext/issues/59330)) ([#59331](https://github.com/frappe/erpnext/issues/59331)) ([1ead4ce](1ead4cebcf))
* refresh price list exchange rate when currency changes ([0fe41ce](0fe41ce92e))
* remove company link filter on asset field in Asset Depreciation Schedule ([a436707](a436707efc))
* render letter head jinja in statement of accounts pdf ([31111a4](31111a4a30))
* resolve conflicts ([98fa0d4](98fa0d4cb4))
* resolve conflicts ([7ff2a33](7ff2a33a5b))
* resolve conflicts ([6fab4e0](6fab4e0203))
* resolve MRP purchase supplier with item group fallback, else throw ([be283b7](be283b70f2))
* retain bom components without warehouse stock ([#59116](https://github.com/frappe/erpnext/issues/59116)) ([18ee3b9](18ee3b9cc0))
* **selling:** use preferred addresses in customer quotations ([c019bb5](c019bb5c28))
* skip serial nos with no stock when reconciling specific serial nos (backport [#59266](https://github.com/frappe/erpnext/issues/59266)) ([#59267](https://github.com/frappe/erpnext/issues/59267)) ([aaaba7c](aaaba7cd82))
* **stock:** allow zero completed quantity and handle process loss in job cards ([#59104](https://github.com/frappe/erpnext/issues/59104)) ([4f984ae](4f984aeecf))
* **stock:** apply transit warehouse filter to target warehouse in items table ([#59192](https://github.com/frappe/erpnext/issues/59192)) ([ae96dad](ae96dad151))
* **stock:** calculate batch bundle valuation per unit ([#58994](https://github.com/frappe/erpnext/issues/58994)) ([110192d](110192d9de))
* **stock:** compare transit quantities in stock UOM (backport [#59202](https://github.com/frappe/erpnext/issues/59202)) ([#59244](https://github.com/frappe/erpnext/issues/59244)) ([0f1cefa](0f1cefa918))
* **stock:** continue putaway allocation after undersized whole-uom rules ([#59155](https://github.com/frappe/erpnext/issues/59155)) ([dbb8981](dbb8981fa1))
* **stock:** deduct rejected qty from the in-transit warehouse ([#59299](https://github.com/frappe/erpnext/issues/59299)) ([4186d6c](4186d6c994))
* **stock:** filter item group defaults by company and non-group records ([#58923](https://github.com/frappe/erpnext/issues/58923)) ([741ae5d](741ae5d33c))
* **stock:** forward company to outward batch lookup ([#59160](https://github.com/frappe/erpnext/issues/59160)) ([5e1cfa4](5e1cfa4f52))
* **stock:** honour pick manually when mapping a pick list ([#59220](https://github.com/frappe/erpnext/issues/59220)) ([3ee9353](3ee9353240))
* **stock:** keep mapped cost center in stock entry items ([#59286](https://github.com/frappe/erpnext/issues/59286)) ([cdbdcc6](cdbdcc6e33))
* **stock:** respect manual picking when mapping sales orders ([58847de](58847de59a))
* **stock:** seed bin values when cancelling a stock voucher ([#59250](https://github.com/frappe/erpnext/issues/59250)) ([3ab13e1](3ab13e12d4)), closes [#57380](https://github.com/frappe/erpnext/issues/57380)
* **stock:** use net purchase values in landed cost vouchers (backport [#59274](https://github.com/frappe/erpnext/issues/59274)) ([#59278](https://github.com/frappe/erpnext/issues/59278)) ([6af5892](6af589208b))
* **stock:** use stored posting_datetime when reposting stock ledger entries ([#58998](https://github.com/frappe/erpnext/issues/58998)) ([39d6f2a](39d6f2a236))
* **stock:** validate warehouse account belongs to selected company ([#59191](https://github.com/frappe/erpnext/issues/59191)) ([38bdb4f](38bdb4f9c0))
* sync translations from crowdin (version-16-hotfix) ([#59210](https://github.com/frappe/erpnext/issues/59210)) ([d217283](d217283229))
* update modified for last purchase rate (backport [#59044](https://github.com/frappe/erpnext/issues/59044)) ([#59106](https://github.com/frappe/erpnext/issues/59106)) ([877747c](877747c133))
* use correct exchange rate for multi-currency bank reconciliation payments ([#59144](https://github.com/frappe/erpnext/issues/59144)) ([427a20c](427a20c508))
* validate bank reconciliation date ranges ([a878951](a878951c17))
* validate coupon pricing rules and validity dates ([2db2244](2db2244852))
* validate shipping rule account company ([590fff6](590fff6a45))
* valuation of serialized items after disabling serial no wise valuation ([#59197](https://github.com/frappe/erpnext/issues/59197)) ([af334da](af334dabcc))
* write off stranded stock value only when the warehouse is empty ([#59216](https://github.com/frappe/erpnext/issues/59216)) ([8bbb73d](8bbb73d2e2))

### Features

* mark update_serial_batch_entries patch as never skippable (backport [#59147](https://github.com/frappe/erpnext/issues/59147)) ([#59148](https://github.com/frappe/erpnext/issues/59148)) ([d2042bc](d2042bc1bb))
* **selling:** group Sales Order Analysis by item (backport [#59236](https://github.com/frappe/erpnext/issues/59236)) ([#59246](https://github.com/frappe/erpnext/issues/59246)) ([814d7f0](814d7f0c4e))
* **stock:** GL-only reposting from Stock and Account Value Comparison report ([#59127](https://github.com/frappe/erpnext/issues/59127)) ([c055faa](c055faabc1))
* use serial no wise valuation switch on item ([#59082](https://github.com/frappe/erpnext/issues/59082)) ([f09ce05](f09ce0583f))

### Performance Improvements

* filter by company in get_returned_invoice_items ([423aa09](423aa09f59))
* reduce memory consumption during reposting (backport [#59117](https://github.com/frappe/erpnext/issues/59117)) ([#59149](https://github.com/frappe/erpnext/issues/59149)) ([16b1821](16b1821f35)), closes [#52152](https://github.com/frappe/erpnext/issues/52152)
* skip legacy batch ledger lookups when no legacy entry exists (backport [#59110](https://github.com/frappe/erpnext/issues/59110)) ([#59111](https://github.com/frappe/erpnext/issues/59111)) ([4af1b0d](4af1b0db4e))
* **stock:** chunk the serial and batch entry backfill patch ([#59076](https://github.com/frappe/erpnext/issues/59076)) ([86fe0c1](86fe0c1f4b))

.github/helper/install.sh

@@ -4,6 +4,36 @@ set -e
 
 cd ~ || exit
 
+# Authenticate git against github.com with the job token: anonymous git-over-HTTPS from the
+# runners gets throttled to a 401, which kills whichever clone is in flight — the frappe fetch
+# below, or payments under `bench get-app`. See the PR description.
+#
+# A credential helper rather than a url.insteadOf rewrite, because `git clone` PERSISTS a
+# rewritten URL into the new repo's .git/config: an insteadOf would leave the token sitting in
+# apps/payments/.git/config on the runner. A helper is consulted only when github.com actually
+# challenges, and leaves the stored remote URL untouched. Passing it through GIT_CONFIG_* keeps
+# the token out of ~/.gitconfig too, and child processes inherit it (bench shells out to git).
+ci_github_token=${CI_GITHUB_TOKEN:-${GITHUB_TOKEN:-}}
+if [ -n "$ci_github_token" ]; then
+    export CI_GITHUB_TOKEN="$ci_github_token"
+    export GIT_CONFIG_COUNT=3
+    # Reset first: git runs EVERY configured helper and calls `store` on them after a successful
+    # auth, so a `credential.helper=store` inherited from the image's gitconfig would write the
+    # token to ~/.git-credentials. An empty value clears the list before ours is added.
+    export GIT_CONFIG_KEY_0="credential.helper"
+    export GIT_CONFIG_VALUE_0=""
+    export GIT_CONFIG_KEY_1="credential.https://github.com.username"
+    export GIT_CONFIG_VALUE_1="x-access-token"
+    export GIT_CONFIG_KEY_2="credential.https://github.com.helper"
+    # Single-quoted: $CI_GITHUB_TOKEN is expanded by the shell git runs the helper in, so the
+    # token is read from the environment at call time and never stored anywhere. Answering only
+    # `get` makes the helper inert for git's `store`/`erase` calls.
+    export GIT_CONFIG_VALUE_2='!f() { test "$1" = get && echo "password=$CI_GITHUB_TOKEN"; }; f'
+fi
+
+# Whatever happens, never sit on a credential prompt: fail fast and legibly instead.
+export GIT_TERMINAL_PROMPT=0
+
 githubbranch=${GITHUB_BASE_REF:-${GITHUB_REF##*/}}
 frappeuser=${FRAPPE_USER:-"frappe"}
 frappecommitish=${FRAPPE_BRANCH:-$githubbranch}

.github/workflows/crowdin-actions-update-main-pot.yml

@@ -0,0 +1,54 @@
+name: Upload main.pot to Crowdin
+
+on:
+  push:
+    branches:
+      - develop
+      - version-16-hotfix
+    paths:
+      - "erpnext/locale/main.pot"
+  workflow_dispatch:
+
+concurrency:
+  group: crowdin-upload-${{ github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  upload-sources:
+    name: Upload sources from ${{ github.ref_name }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout ${{ github.ref_name }}
+        uses: actions/checkout@v6
+
+      - name: Restore Crowdin cache
+        uses: actions/cache/restore@v6
+        with:
+          path: .crowdin
+          key: crowdin-${{ github.ref_name }}
+          restore-keys: crowdin-${{ github.ref_name }}-
+
+      - name: Upload main.pot to Crowdin
+        uses: crowdin/github-action@8f01d54f70f1713ee3f09d82c2bbb2daeac28689 # v2.17.1
+        with:
+          config: crowdin.yml
+          upload_sources: true
+          upload_translations: false
+          download_translations: false
+          create_pull_request: false
+          crowdin_branch_name: "[frappe.erpnext] ${{ github.ref_name }}"
+          upload_sources_args: "--cache"
+        env:
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Save Crowdin cache
+        uses: actions/cache/save@v6
+        if: always()
+        with:
+          path: .crowdin
+          key: crowdin-${{ github.ref_name }}-${{ github.run_id }}

.github/workflows/patch.yml

@@ -105,6 +105,8 @@ jobs:
         env:
           DB: mariadb
           TYPE: server
+          # Anonymous git to github.com gets throttled to a 401; authenticate the clones.
+          CI_GITHUB_TOKEN: ${{ github.token }}
 
       - name: Run Patch Tests
         run: |

.github/workflows/review-translation-changes.yaml

@@ -22,4 +22,4 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: alyf-de/po-review-action@v1.1.0
+      - uses: alyf-de/po-review-action@5928f84d6bc9094f9ad6e2c5780f01c0044b800e # v1.1.1

.github/workflows/run-individual-tests.yml

@@ -129,6 +129,8 @@ jobs:
           TYPE: server
           FRAPPE_USER: ${{ github.event.inputs.user }}
           FRAPPE_BRANCH: ${{ github.event.inputs.branch }}
+          # Anonymous git to github.com gets throttled to a 401; authenticate the clones.
+          CI_GITHUB_TOKEN: ${{ github.token }}
 
       - name: Run Tests
         run: |

.github/workflows/server-tests-mariadb-faux.yml

@@ -13,6 +13,7 @@ on:
       - 'crowdin.yml'
       - '.coderabbit.yml'
       - '.mergify.yml'
+      - '**.po'
 
 permissions:
   contents: read

.github/workflows/server-tests-mariadb.yml

@@ -13,6 +13,7 @@ on:
       - 'crowdin.yml'
       - '.coderabbit.yml'
       - '.mergify.yml'
+      - '**.po'
   schedule:
     # Run everday at midnight UTC / 5:30 IST
     - cron: "0 0 * * *"
@@ -101,6 +102,8 @@ jobs:
           TYPE: server
           FRAPPE_USER: ${{ github.event.inputs.user }}
           FRAPPE_BRANCH: ${{ github.event.client_payload.sha || github.event.inputs.branch }}
+          # Anonymous git to github.com gets throttled to a 401; authenticate the clones.
+          CI_GITHUB_TOKEN: ${{ github.token }}
           DB_HOST: 127.0.0.1
           DB_USER_HOST: '%'
           WKHTMLTOX_DEB: /tmp/wkhtmltox.deb

banking/package.json

@@ -24,10 +24,10 @@
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "dayjs": "^1.11.20",
-    "frappe-react-sdk": "^1.17.0",
+    "frappe-react-sdk": "^1.17.1",
     "fuse.js": "^7.3.0",
-    "jotai": "^2.20.1",
-    "jotai-family": "^1.0.2",
+    "jotai": "^2.20.2",
+    "jotai-family": "^1.1.0",
     "lodash.isplainobject": "^4.0.6",
     "lucide-react": "^1.14.0",
     "radix-ui": "^1.6.1",
@@ -39,7 +39,7 @@
     "react-hook-form": "^7.75.0",
     "react-hotkeys-hook": "^5.3.2",
     "react-markdown": "^10.1.0",
-    "react-router": "^8.1.0",
+    "react-router": "^8.3.0",
     "rehype-raw": "^7.0.0",
     "remark-gfm": "^4.0.1",
     "safe-expr-eval": "^1.0.4",
@@ -48,18 +48,18 @@
     "tailwindcss": "^4.3.0",
     "tw-animate-css": "^1.4.0",
     "usehooks-ts": "^3.1.1",
-    "vite": "^8.0.16"
+    "vite": "^8.2.1"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.4",
+    "@eslint/js": "^9.39.5",
     "@types/node": "^25.3.0",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
-    "eslint": "^9.39.1",
+    "eslint": "^10.8.1",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-react-refresh": "^0.5.3",
     "globals": "^16.5.0",
     "typescript": "~5.9.3",
-    "typescript-eslint": "^8.62.1"
+    "typescript-eslint": "^8.67.0"
   }
 }

banking/src/components/common/AccountsDropdown.tsx

@@ -9,6 +9,7 @@ import Fuse from "fuse.js"
 import { ChevronDownIcon } from "lucide-react"
 import { useLayoutEffect, useMemo, useRef, useState } from "react"
 import { FormControl } from "../ui/form"
+import useResetScrollOnSearch from "@/hooks/useResetScrollOnSearch"
 
 
 export interface AccountsDropdownProps {
@@ -104,6 +105,10 @@ const AccountsDropdown = ({ root_type, report_type, account_type, value, onChang
 
     const buttonRef = useRef<HTMLButtonElement>(null)
 
+    // Searching replaces the grouped list with a short result list, so pin the scroll back to
+    // the top - otherwise the auto-selected first result can be out of view.
+    const listRef = useResetScrollOnSearch(search)
+
     const [width, setWidth] = useState(320)
 
     useLayoutEffect(() => {
@@ -153,7 +158,7 @@ const AccountsDropdown = ({ root_type, report_type, account_type, value, onChang
             <PopoverContent className="p-0" style={{ minWidth: width }} align="start">
                 <Command shouldFilter={false} className="w-full">
                     <CommandInput placeholder={_("Search account...")} onValueChange={setSearch} value={search} />
-                    <CommandList>
+                    <CommandList ref={listRef}>
                         <CommandEmpty>{_("No accounts found.")}</CommandEmpty>
 
                         {recommendedAccounts.length > 0 && (

banking/src/components/common/LinkFieldCombobox.tsx

@@ -10,6 +10,7 @@ import { ChevronDownIcon, ExternalLink } from "lucide-react";
 import { Button } from "../ui/button";
 import { cn } from "@/lib/utils";
 import { Command, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandList } from "../ui/command";
+import useResetScrollOnSearch from "@/hooks/useResetScrollOnSearch";
 import _ from "@/lib/translate";
 import ErrorBanner from "../ui/error-banner";
 import MarkdownRenderer from "../ui/markdown";
@@ -149,6 +150,10 @@ const LinkFieldCombobox = ({
 
     const buttonRef = useRef<HTMLButtonElement>(null)
 
+    // Results change as the search runs, so pin the scroll back to the top to keep the
+    // auto-selected first result in view.
+    const listRef = useResetScrollOnSearch(searchInput)
+
     const [width, setWidth] = useState(320)
 
     useLayoutEffect(() => {
@@ -264,7 +269,7 @@ const LinkFieldCombobox = ({
                 {error && <ErrorBanner error={error} />}
                 <Command shouldFilter={false} className="w-full">
                     <CommandInput placeholder={placeholder} onValueChange={setSearchInput} />
-                    <CommandList>
+                    <CommandList ref={listRef}>
                         <CommandEmpty>{isLoading ? _("Loading...") : _("No results found.")}</CommandEmpty>
                         <CommandGroup>
                             {items?.map((result) => (
@@ -272,7 +277,7 @@ const LinkFieldCombobox = ({
                                     <span className="font-medium">
                                         {result.label || result.value}
                                     </span>
-                                    {result.description && <span className="text-xs text-ink-gray-5">
+                                    {result.description && <span className="text-p-xs text-ink-gray-5">
                                         <MarkdownRenderer content={result.description} />
                                     </span>}
                                 </CommandItem>

banking/src/components/features/BankReconciliation/BankBalance.tsx

@@ -6,13 +6,13 @@ import { Progress } from "@/components/ui/progress"
 import { useGetAccountClosingBalance, useGetAccountClosingBalanceAsPerStatement, useGetAccountOpeningBalance, useGetUnreconciledTransactions } from "./utils"
 import { flt, formatCurrency } from "@/lib/numbers"
 import { Skeleton } from "@/components/ui/skeleton"
-import { StatContainer, StatLabel, StatValue } from "@/components/ui/stats"
 import { Edit, Info, Trash2 } from "lucide-react"
 import { H4, Paragraph } from "@/components/ui/typography"
 import { HoverCard, HoverCardContent, HoverCardTrigger } from "@/components/ui/hover-card"
 import { getCompanyCurrency } from "@/lib/company"
 import _ from "@/lib/translate"
-import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle, DialogTrigger } from "@/components/ui/dialog"
+import { cn } from "@/lib/utils"
+import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog"
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip"
 import { formatDate } from "@/lib/date"
 import { Form } from "@/components/ui/form"
@@ -26,50 +26,109 @@ import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@
 import { toast } from "sonner"
 import ErrorBanner from "@/components/ui/error-banner"
 
-const BankBalance = () => {
+const useBankCurrency = () => {
+    const bankAccount = useAtomValue(selectedBankAccountAtom)
+    return bankAccount?.account_currency ?? getCompanyCurrency(bankAccount?.company ?? '')
+}
+
+/**
+ * One line of the balance summary - label on the left, figure right-aligned.
+ *
+ * `items-baseline` keeps the figure on the label's FIRST line, so a row carrying a `subLabel`
+ * (the statement row's "As of <date>" note) doesn't centre its value against both lines.
+ */
+const BalanceRow = ({ label, info, subLabel, emphasis, children }: {
+    label: React.ReactNode
+    info?: React.ReactNode
+    subLabel?: React.ReactNode
+    emphasis?: boolean
+    children: React.ReactNode
+}) => (
+    <div className="flex items-baseline justify-between gap-3">
+        <span className="flex min-w-0 flex-col gap-1.5">
+            <span className={cn("flex items-center gap-1 whitespace-nowrap text-xs text-ink-gray-6",
+                emphasis && "font-medium text-ink-gray-7")}>
+                {label}
+                {info}
+            </span>
+            {subLabel}
+        </span>
+        <div className="flex flex-col items-end">{children}</div>
+    </div>
+)
+
+/**
+ * Type styles for a figure. Shared so an interactive figure can put them on the <button>
+ * ITSELF rather than on a nested span: Tailwind's preflight sets `font: inherit` on buttons,
+ * which resets line-height too, so a button wrapping a `text-sm` span gets a taller strut than
+ * the span and the row grows - visible as extra space above a baseline-aligned row.
+ */
+const BALANCE_VALUE_CLASSES = "font-numeric text-sm tabular-nums text-ink-gray-8"
+
+const BalanceValue = ({ children, emphasis, tone, className }: { children: React.ReactNode, emphasis?: boolean, tone?: 'red', className?: string }) => (
+    <span className={cn(BALANCE_VALUE_CLASSES,
+        emphasis && "font-semibold",
+        tone === 'red' && "text-ink-red-3",
+        className)}>
+        {children}
+    </span>
+)
+
+const BalanceSkeleton = () => <Skeleton className="h-4 w-24 rounded-sm" />
+
+/**
+ * Balances and progress for the selected bank account, laid out like the totals block of an
+ * invoice. This sits beside the bank picker rather than in a row of its own (saves vertical
+ * space) and outside the picker's horizontal scroll area, so the figures being reconciled
+ * against can never scroll out of view.
+ */
+const BankAccountBalancePanel = () => {
 
     const bankAccount = useAtomValue(selectedBankAccountAtom)
 
     if (!bankAccount) {
         return null
     }
-    return (
-        <div className="flex justify-between">
-            <div className="w-[80%] flex flex-wrap justify-between gap-2 pe-8 border-e-border border-e">
-                <OpeningBalance />
-                <ClosingBalance />
-                <ClosingBalanceAsPerStatement />
-                <Difference />
-            </div>
 
-            <ReconcileProgress />
+    return (
+        <div className="flex w-72 shrink-0 flex-col justify-center gap-2.5 border-s border-outline-gray-2 ps-4">
+            {/* Names the account these figures belong to - the picker scrolls, so the
+                highlighted card can't be relied on as the referent. */}
+            <span
+                className="truncate text-xs font-medium text-ink-gray-7"
+                title={bankAccount.account_name}>
+                {bankAccount.account_name}
+            </span>
+            <OpeningBalanceRow />
+            <SystemClosingBalanceRow />
+            <StatementClosingBalanceRow />
+            <Separator />
+            <DifferenceRow />
+            <ReconciledRow />
         </div>
     )
 }
 
-const OpeningBalance = () => {
-    const bankAccount = useAtomValue(selectedBankAccountAtom)
+const OpeningBalanceRow = () => {
+    const currency = useBankCurrency()
     const { data, isLoading } = useGetAccountOpeningBalance()
 
-    return <StatContainer className="min-w-48">
-        <StatLabel>{_("Opening Balance")}</StatLabel>
-        {isLoading ? <Skeleton className="w-[150px] h-5 rounded-sm" /> : <StatValue className="font-numeric">{formatCurrency(flt(data?.message, 2), bankAccount?.account_currency ?? getCompanyCurrency(bankAccount?.company ?? ''))}</StatValue>}
-    </StatContainer>
+    return <BalanceRow label={_("Opening Balance")}>
+        {isLoading ? <BalanceSkeleton /> : <BalanceValue>{formatCurrency(flt(data?.message, 2), currency)}</BalanceValue>}
+    </BalanceRow>
 }
 
-const ClosingBalance = () => {
-    const bankAccount = useAtomValue(selectedBankAccountAtom)
+const SystemClosingBalanceRow = () => {
+    const currency = useBankCurrency()
     const { data, isLoading } = useGetAccountClosingBalance()
 
     return (
-        <StatContainer className="min-w-48">
-            <div className="flex items-start gap-1">
-                <StatLabel>
-                    {_("Closing Balance as per system")}
-                </StatLabel>
+        <BalanceRow
+            label={_("Closing (system)")}
+            info={
                 <HoverCard openDelay={100}>
                     <HoverCardTrigger>
-                        <Info className="size-3.5 text-ink-gray-6 -mt-px" />
+                        <Info className="size-3.5 text-ink-gray-6" />
                     </HoverCardTrigger>
                     <HoverCardContent className="w-96" align="start" side="right">
                         <H4 className="text-base">{_("Closing balance as per system")}</H4>
@@ -84,15 +143,111 @@ const ClosingBalance = () => {
                         </Paragraph>
                     </HoverCardContent>
                 </HoverCard>
-
-            </div>
-            {isLoading ? <Skeleton className="w-[150px] h-5 rounded-sm" /> : <StatValue className="font-numeric">{formatCurrency(flt(data?.message, 2), bankAccount?.account_currency ?? getCompanyCurrency(bankAccount?.company ?? ''))}</StatValue>}
-        </StatContainer>
+            }
+        >
+            {isLoading ? <BalanceSkeleton /> : <BalanceValue>{formatCurrency(flt(data?.message, 2), currency)}</BalanceValue>}
+        </BalanceRow>
     )
 }
 
-const Difference = () => {
+const StatementClosingBalanceRow = () => {
+
     const bankAccount = useAtomValue(selectedBankAccountAtom)
+    const currency = useBankCurrency()
+    const dates = useAtomValue(bankRecDateAtom)
+    const setValue = useSetAtom(bankRecClosingBalanceAtom(bankAccount?.name ?? ''))
+
+    const { data, isLoading } = useGetAccountClosingBalanceAsPerStatement({
+        onSuccess: (data) => {
+            if (data?.message && data?.message?.balance) {
+                setValue({
+                    value: data?.message?.balance,
+                    stringValue: data?.message?.balance.toString()
+                })
+            }
+        }
+    })
+
+    const isDateSame = data?.message?.date === dates.toDate
+
+    // The server uses the returned date to distinguish an unset balance from a saved zero.
+    const hasBalance = Boolean(data?.message?.date)
+
+    const [isOpen, setIsOpen] = useState(false)
+
+    const tooltip = hasBalance
+        ? _("Click to change the closing balance as per statement")
+        : _("Click to set the closing balance as per statement")
+
+    return (
+        <BalanceRow
+            label={_("Closing (statement)")}
+            // The pencil sits beside the label, mirroring the info icon on the row above, so
+            // the figure stays a plain right-aligned number in line with every other row.
+            info={
+                <Tooltip>
+                    <TooltipTrigger asChild>
+                        {/* `p-0`: Tailwind's preflight gives buttons `appearance: button` but
+                            doesn't reset padding, so a bare button picks up the UA's ~1px 6px
+                            and knocks this row out of step with its neighbours. */}
+                        <button
+                            type='button'
+                            aria-label={tooltip}
+                            onClick={() => setIsOpen(true)}
+                            className="cursor-pointer p-0 text-ink-gray-5 transition-colors hover:text-ink-gray-7">
+                            <Edit className="size-3.5" />
+                        </button>
+                    </TooltipTrigger>
+                    <TooltipContent>{tooltip}</TooltipContent>
+                </Tooltip>
+            }
+            subLabel={!isDateSame && data?.message.date
+                ? <span className="whitespace-nowrap text-2xs font-medium text-ink-red-3">
+                    {_("As of {0}", [formatDate(data?.message?.date ?? '', 'Do MMM YYYY')])}
+                </span>
+                : undefined}
+        >
+            {/* Deliberately NOT a flex container: a flex box's baseline doesn't resolve to its
+                text, so the row's `items-baseline` couldn't line this up with the label. As a
+                plain inline button its baseline is the figure's own, like every other row.
+                "Set" gets the same treatment as a figure - it stands in for one. */}
+            {isLoading
+                ? <BalanceSkeleton />
+                : <Tooltip>
+                    <TooltipTrigger asChild>
+                        {/* The figure styles live on the button itself - see
+                            BALANCE_VALUE_CLASSES. `p-0` because preflight leaves the UA's
+                            button padding in place. */}
+                        <button
+                            type='button'
+                            aria-label={tooltip}
+                            onClick={() => setIsOpen(true)}
+                            className={cn(BALANCE_VALUE_CLASSES,
+                                "cursor-pointer p-0 underline decoration-outline-gray-5 decoration-dashed underline-offset-4",
+                                "transition-colors hover:decoration-ink-gray-8")}>
+                            {hasBalance ? formatCurrency(flt(data?.message?.balance, 2), currency) : _("Set")}
+                        </button>
+                    </TooltipTrigger>
+                    <TooltipContent>{tooltip}</TooltipContent>
+                </Tooltip>}
+
+            <Dialog open={isOpen} onOpenChange={setIsOpen}>
+                <DialogContent className="min-w-xl">
+                    <ClosingBalanceForm
+                        defaultBalance={data?.message?.balance ?? 0}
+                        date={dates.toDate}
+                        bankAccount={bankAccount}
+                        onClose={() => setIsOpen(false)}
+                    />
+                </DialogContent>
+            </Dialog>
+        </BalanceRow>
+    )
+}
+
+const DifferenceRow = () => {
+    const bankAccount = useAtomValue(selectedBankAccountAtom)
+    const currency = useBankCurrency()
 
     const { data, isLoading } = useGetAccountClosingBalance()
 
@@ -102,16 +257,15 @@ const Difference = () => {
 
     const isError = difference !== 0
 
-    return <StatContainer className="w-fit text-end sm:min-w-56">
-        <StatLabel className="text-end">{_("Difference")}</StatLabel>
-        {isLoading ? <Skeleton className="w-[150px] h-5 self-end rounded-sm" /> : <StatValue className={isError ? 'text-ink-red-3 font-numeric' : 'font-numeric'}>
-            {formatCurrency(difference,
-                bankAccount?.account_currency ?? getCompanyCurrency(bankAccount?.company ?? ''))
-            }</StatValue>}
-    </StatContainer>
+    return <BalanceRow label={_("Difference")} emphasis>
+        {isLoading
+            ? <BalanceSkeleton />
+            : <BalanceValue emphasis tone={isError ? 'red' : undefined}>{formatCurrency(difference, currency)}</BalanceValue>}
+    </BalanceRow>
 }
 
-const ReconcileProgress = () => {
+/** Reconciliation progress through the selected date range: a count plus a slim bar. */
+const ReconciledRow = () => {
 
     const bankAccount = useAtomValue(selectedBankAccountAtom)
 
@@ -132,75 +286,14 @@ const ReconcileProgress = () => {
 
     const progress = (totalCount ? reconciledCount / totalCount : 0) * 100
 
-    return <div className="w-[18%] flex flex-col gap-1 items-end">
-        <div className="w-full">
-            <Progress
-                value={progress}
-                max={100}
-                size="md"
-                label="Progress"
-                hint
-                hintText={`${reconciledCount} / ${totalCount} ${_("reconciled")}`} />
-        </div>
+    return <div className="flex flex-col gap-1.5">
+        <BalanceRow label={_("Reconciled")}>
+            <BalanceValue>{reconciledCount} / {totalCount ?? 0}</BalanceValue>
+        </BalanceRow>
+        <Progress value={progress} max={100} size="sm" />
     </div>
 }
 
-const ClosingBalanceAsPerStatement = () => {
-
-    const bankAccount = useAtomValue(selectedBankAccountAtom)
-    const dates = useAtomValue(bankRecDateAtom)
-    const setValue = useSetAtom(bankRecClosingBalanceAtom(bankAccount?.name ?? ''))
-
-    const { data, isLoading } = useGetAccountClosingBalanceAsPerStatement({
-        onSuccess: (data) => {
-            if (data?.message && data?.message?.balance) {
-                setValue({
-                    value: data?.message?.balance,
-                    stringValue: data?.message?.balance.toString()
-                })
-            }
-        }
-    })
-
-    const isDateSame = data?.message?.date === dates.toDate
-
-    const [isOpen, setIsOpen] = useState(false)
-
-
-    return <StatContainer className="min-w-48">
-        <StatLabel>{_("Closing Balance as per statement")}</StatLabel>
-        <div className="flex flex-col gap-2 items-start">
-            <Dialog open={isOpen} onOpenChange={setIsOpen}>
-                <DialogTrigger>
-                    <Tooltip>
-                        <TooltipTrigger asChild>
-                            <div className="flex items-center gap-4 underline cursor-pointer underline-offset-6" role="button">
-                                {isLoading ? <Skeleton className="w-[150px] h-5 rounded-sm" /> : <StatValue className="font-numeric">{formatCurrency(flt(data?.message?.balance, 2), bankAccount?.account_currency ?? getCompanyCurrency(bankAccount?.company ?? ''))}</StatValue>}
-                                <Edit className="w-4 h-4" />
-                            </div>
-                        </TooltipTrigger>
-                        <TooltipContent>
-                            {_("Click to set the closing balance as per statement")}
-                        </TooltipContent>
-                    </Tooltip>
-                </DialogTrigger>
-                <DialogContent className="min-w-xl">
-                    <ClosingBalanceForm
-                        defaultBalance={data?.message?.balance ?? 0}
-                        date={dates.toDate}
-                        bankAccount={bankAccount}
-                        onClose={() => setIsOpen(false)}
-                    />
-
-
-                </DialogContent>
-            </Dialog>
-            {!isDateSame && data?.message.date && <span className="text-xs font-medium text-ink-red-3">{_("As of {0}", [formatDate(data?.message?.date ?? '', 'Do MMM YYYY')])}</span>}
-        </div>
-    </StatContainer>
-
-}
-
 const ClosingBalanceForm = ({ defaultBalance, date, bankAccount, onClose }: { defaultBalance: number, date: string, bankAccount: SelectedBank | null, onClose: VoidFunction }) => {
 
     const { mutate } = useSWRConfig()
@@ -302,7 +395,7 @@ const ClosingBalancesList = ({ bankAccount, date }: { bankAccount: SelectedBank
 
     return <div>
         <Separator className="my-8" />
-        <p className="text-sm text-center">{_("Balances as per bank statement before {0}", [formatDate(date, 'Do MMM YYYY')])}</p>
+        <p className="text-p-sm text-center pb-2">{_("Balances as per bank statement before {0}", [formatDate(date, 'Do MMM YYYY')])}</p>
         <Table>
             <TableHeader>
                 <TableRow>
@@ -331,4 +424,4 @@ const ClosingBalancesList = ({ bankAccount, date }: { bankAccount: SelectedBank
 
 }
 
-export default BankBalance
+export default BankAccountBalancePanel

banking/src/components/features/BankReconciliation/BankClearanceSummary.tsx

@@ -205,9 +205,9 @@ const BankClearanceSummaryView = () => {
 
     const content = _("Below is a list of all accounting entries posted against the bank account {0} between {1} and {2}.", [`<strong>${bankAccount?.account}</strong>`, `<strong>${formattedFromDate}</strong>`, `<strong>${formattedToDate}</strong>`])
 
-    return <div className="space-y-4 py-2">
+    return <div className="flex min-h-0 flex-1 flex-col space-y-4 py-2">
 
-        <div>
+        <div className="shrink-0">
             <span className="text-p-sm">
                 <MarkdownRenderer content={content} />
             </span>
@@ -220,8 +220,9 @@ const BankClearanceSummaryView = () => {
                 data={data.message.result}
                 columns={clearanceColumns}
                 getRowId={(row) => `${row.payment_entry}-${row.posting_date}`}
-                maxHeight="calc(100vh - 200px)"
-                scrollAreaClassName="min-h-[calc(100vh-200px)]"
+                className="min-h-0 flex-1"
+                maxHeight="none"
+                scrollAreaClassName="flex-1"
                 emptyState={_("No rows to display.")}
             />
         ) : null}

banking/src/components/features/BankReconciliation/BankPicker.tsx

@@ -74,7 +74,10 @@ const BankPicker = ({ className }: { className?: string }) => {
     }
     return (
         <div
-            className={cn("flex gap-3 items-stretch w-full overflow-x-auto pe-4",
+            // No trailing padding: it would sit inside the fade region, so the mask would
+            // spend itself on empty space and the last card would stop short of the balance
+            // panel instead of fading towards it. The column gap provides the separation.
+            className={cn("flex gap-3 items-stretch w-full overflow-x-auto scroll-fade-x",
                 banks?.length > 4 ? 'pb-2' : '', className,
             )}
             style={{
@@ -108,12 +111,12 @@ const BankPickerItem = ({ bank }: { bank: SelectedBank }) => {
         role="button"
         title={`Select ${bank.account_name}`}
         onClick={onSelect}
-        className={cn('rounded-md border border-outline-gray-1 max-w-60 min-w-60 p-2 overflow-hidden cursor-pointer',
+        // `shrink-0`: this is a horizontally scrolling row, so cards keep their own width
+        // instead of being compressed to fit the container.
+        className={cn('w-60 shrink-0 rounded-md border border-outline-gray-1 p-2 overflow-hidden cursor-pointer transition-colors',
             isSelected ? 'border-outline-gray-5 bg-surface-gray-1' : 'hover:bg-surface-gray-1'
         )}
     >
-
-
         <BankLogo bank={bank} className="mb-2" />
 
         <div className="flex flex-col gap-1">

banking/src/components/features/BankReconciliation/BankRecDateFilter.tsx

@@ -5,107 +5,179 @@ import { AVAILABLE_TIME_PERIODS, formatDate, getDatesForTimePeriod, TimePeriod }
 import { Button } from '@/components/ui/button'
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
 import { ChevronDownIcon, ChevronLeftIcon, ChevronRight } from 'lucide-react'
-import { Command, CommandEmpty, CommandInput, CommandItem, CommandList } from '@/components/ui/command'
+import { Command, CommandGroup, CommandInput, CommandItem, CommandList } from '@/components/ui/command'
 import { parse } from "chrono-node"
 import { Calendar } from '@/components/ui/calendar'
 import useFiscalYear from '@/hooks/useFiscalYear'
 import dayjs from 'dayjs'
 import _ from '@/lib/translate'
 import { useDirection } from '@/components/ui/direction'
+import useResetScrollOnSearch from '@/hooks/useResetScrollOnSearch'
+
+const DATE_FORMAT = 'YYYY-MM-DD'
+
+/** Current fiscal year plus this many previous ones, for quarter/year options. */
+const PREVIOUS_FISCAL_YEARS = 2
+
+type DateOption = {
+    /** Stable id - used as the cmdk value and the React key. */
+    key: string
+    label: string
+    translatedLabel: string
+    fromDate: string
+    toDate: string
+    format: string
+    /** Extra terms to match against, beyond the labels and dates. */
+    keywords?: string[]
+    /** Whether to show this option when the search box is empty. */
+    isDefault?: boolean
+}
+
+/**
+ * Fiscal years keep the same month/day boundaries year on year, so previous years can be
+ * derived by subtracting whole years instead of fetching them. Works for both Jan-Dec and
+ * Apr-Mar style fiscal years.
+ */
+const fiscalYearLabel = (start: dayjs.Dayjs, end: dayjs.Dayjs) =>
+    start.year() === end.year() ? `${start.year()}` : `${start.year()}-${end.year()}`
 
 const BankRecDateFilter = () => {
 
     const [bankRecDate, setBankRecDate] = useAtom(bankRecDateAtom)
 
-    const { data: fiscalYear } = useFiscalYear()
+    const { fiscalYear } = useFiscalYear()
 
-    const timePeriodOptions = useMemo(() => {
-        const standardOptions = AVAILABLE_TIME_PERIODS.map((period) => {
+    const today = useMemo(() => dayjs().format(DATE_FORMAT), [])
+
+    const allOptions = useMemo(() => {
+        const standardOptions: DateOption[] = AVAILABLE_TIME_PERIODS.map((period) => {
             const dates = getDatesForTimePeriod(period)
             return {
+                key: period,
                 label: period,
+                translatedLabel: dates.translatedLabel ?? _(period),
                 fromDate: dates.fromDate,
                 toDate: dates.toDate,
                 format: dates.format,
-                translatedLabel: dates.translatedLabel
+                isDefault: true,
             }
         })
 
-        if (fiscalYear?.message) {
-            // For a fiscal year, we need to replace "Last Year", "This Year", and add options for quarters
-            const fiscalYearStart = fiscalYear.message.year_start_date
-            const fiscalYearEnd = fiscalYear.message.year_end_date
-
-            const q1 = {
-                label: `Q1: ${fiscalYear.message.name}`,
-                translatedLabel: `${_("Q1")}: ${fiscalYear.message.name}`,
-                fromDate: fiscalYearStart,
-                toDate: dayjs(fiscalYearStart).add(3, 'month').format('YYYY-MM-DD'),
-                format: 'MMM YYYY'
-            }
-
-            const q2 = {
-                label: `Q2: ${fiscalYear.message.name}`,
-                translatedLabel: `${_("Q2")}: ${fiscalYear.message.name}`,
-                fromDate: dayjs(fiscalYearStart).add(3, 'month').format('YYYY-MM-DD'),
-                toDate: dayjs(fiscalYearStart).add(6, 'month').format('YYYY-MM-DD'),
-                format: 'MMM YYYY'
-            }
-
-            const q3 = {
-                label: `Q3: ${fiscalYear.message.name}`,
-                translatedLabel: `${_("Q3")}: ${fiscalYear.message.name}`,
-                fromDate: dayjs(fiscalYearStart).add(6, 'month').format('YYYY-MM-DD'),
-                toDate: dayjs(fiscalYearStart).add(9, 'month').format('YYYY-MM-DD'),
-                format: 'MMM YYYY'
-            }
-
-            const q4 = {
-                label: `Q4: ${fiscalYear.message.name}`,
-                translatedLabel: `${_("Q4")}: ${fiscalYear.message.name}`,
-                fromDate: dayjs(fiscalYearStart).add(9, 'month').format('YYYY-MM-DD'),
-                toDate: fiscalYearEnd,
-                format: 'MMM YYYY'
-            }
-
-            const thisYear = {
-                label: `This Fiscal Year`,
-                translatedLabel: `${_("This Fiscal Year")}`,
-                fromDate: fiscalYearStart,
-                toDate: fiscalYearEnd,
-                format: 'MMM YYYY'
-            }
-
-            const lastYear = {
-                label: `Last Fiscal Year`,
-                translatedLabel: `${_("Last Fiscal Year")}`,
-                fromDate: dayjs(fiscalYearStart).subtract(1, 'year').format('YYYY-MM-DD'),
-                toDate: dayjs(fiscalYearEnd).subtract(1, 'year').format('YYYY-MM-DD'),
-                format: 'MMM YYYY'
-            }
-            // Sort the options so that we get "This Month", "Last Month", quarters, fiscal year, then the rest of the standard options
-
-            const topRankedItems = standardOptions.filter((option) => {
-                return option.label === "This Month" || option.label === "Last Month"
-            })
-
-            const bottomRankedItems = standardOptions.filter((option) => {
-                return option.label !== "This Month" && option.label !== "Last Month"
-            })
-
-            return [...topRankedItems, q1, q2, q3, q4, thisYear, lastYear, ...bottomRankedItems]
+        if (!fiscalYear) {
+            return standardOptions
         }
 
-        return standardOptions
+        const currentStart = dayjs(fiscalYear.year_start_date)
+        const currentEnd = dayjs(fiscalYear.year_end_date)
+
+        const quarterOptions: DateOption[] = []
+        const fiscalYearOptions: DateOption[] = []
+
+        // Static literals so the translation extractor can find them.
+        const quarterLabels = [_("Q1"), _("Q2"), _("Q3"), _("Q4")]
+
+        for (let yearsAgo = 0; yearsAgo <= PREVIOUS_FISCAL_YEARS; yearsAgo++) {
+            const start = currentStart.subtract(yearsAgo, 'year')
+            const end = currentEnd.subtract(yearsAgo, 'year')
+            // Keep the real name for the current year; derive it for the earlier ones.
+            const yearLabel = yearsAgo === 0 ? fiscalYear.name : fiscalYearLabel(start, end)
+
+            for (let quarter = 0; quarter < 4; quarter++) {
+                const quarterStart = start.add(quarter * 3, 'month')
+                // End the day before the next quarter starts, clamped to the fiscal year end
+                // so a short fiscal year can't spill over.
+                const nextQuarterStart = start.add((quarter + 1) * 3, 'month')
+                const quarterEnd = nextQuarterStart.subtract(1, 'day').isAfter(end)
+                    ? end
+                    : nextQuarterStart.subtract(1, 'day')
+
+                if (quarterStart.isAfter(end)) continue
+
+                quarterOptions.push({
+                    key: `Q${quarter + 1}-${yearLabel}`,
+                    label: `Q${quarter + 1}: ${yearLabel}`,
+                    translatedLabel: `${quarterLabels[quarter]}: ${yearLabel}`,
+                    fromDate: quarterStart.format(DATE_FORMAT),
+                    toDate: quarterEnd.format(DATE_FORMAT),
+                    format: 'MMM YYYY',
+                    keywords: ['quarter', `q${quarter + 1}`, yearLabel],
+                    // Only the current fiscal year's quarters clutter the default list;
+                    // older ones stay searchable.
+                    isDefault: yearsAgo === 0,
+                })
+            }
+
+            const label = yearsAgo === 0
+                ? 'This Fiscal Year'
+                : yearsAgo === 1
+                    ? 'Last Fiscal Year'
+                    : `FY ${yearLabel}`
+
+            fiscalYearOptions.push({
+                key: `fiscal-year-${yearLabel}`,
+                label,
+                translatedLabel: yearsAgo <= 1 ? _(label) : `${_("FY")} ${yearLabel}`,
+                fromDate: start.format(DATE_FORMAT),
+                toDate: end.format(DATE_FORMAT),
+                format: 'MMM YYYY',
+                keywords: ['fiscal year', yearLabel],
+                isDefault: yearsAgo <= 1,
+            })
+        }
+
+        // "This Month"/"Last Month" first, then quarters and fiscal years, then the rest.
+        const topRanked = standardOptions.filter((o) => o.label === 'This Month' || o.label === 'Last Month')
+        const bottomRanked = standardOptions.filter((o) => o.label !== 'This Month' && o.label !== 'Last Month')
+
+        return [...topRanked, ...quarterOptions, ...fiscalYearOptions, ...bottomRanked]
     }, [fiscalYear])
 
+    // Reconciliation only looks backwards, so a period that hasn't started is never useful.
+    const selectableOptions = useMemo(
+        () => allOptions.filter((option) => option.fromDate <= today),
+        [allOptions, today],
+    )
+
     const [open, setOpen] = useState(false)
     const [value, setValue] = useState("")
 
+    // We filter ourselves (`shouldFilter={false}`) so that the parsed-date suggestion can be a
+    // real CommandItem alongside the predefined options, and keyboard navigation covers both.
+    const filteredOptions = useMemo(() => {
+        const query = value.trim().toLowerCase()
+
+        if (!query) {
+            return selectableOptions.filter((option) => option.isDefault)
+        }
+
+        const tokens = query.split(/\s+/)
+
+        return selectableOptions.filter((option) => {
+            const haystack = [
+                option.label,
+                option.translatedLabel,
+                ...(option.keywords ?? []),
+                option.fromDate,
+                option.toDate,
+            ].join(' ').toLowerCase()
+
+            return tokens.every((token) => haystack.includes(token))
+        })
+    }, [selectableOptions, value])
+
+    const parsedOption = useMemo(() => parseDateRange(value), [value])
+
+    // Filtering shortens the list, so pin the scroll back to the top to keep the
+    // auto-selected first option in view.
+    const listRef = useResetScrollOnSearch(value)
+
+    // Don't show a parsed suggestion that duplicates an option already in the list.
+    const showParsedOption = parsedOption
+        && !filteredOptions.some((o) => o.fromDate === parsedOption.fromDate && o.toDate === parsedOption.toDate)
+
     const timePeriod: TimePeriod | string = useMemo(() => {
         if (bankRecDate.fromDate && bankRecDate.toDate) {
-            // Check if the from and to dates match any predefined time period
-            for (const period of timePeriodOptions) {
+            for (const period of allOptions) {
                 if (period.fromDate === bankRecDate.fromDate && period.toDate === bankRecDate.toDate) {
                     return period.label;
                 }
@@ -114,10 +186,11 @@ const BankRecDateFilter = () => {
         } else {
             return "Date Range";
         }
-    }, [bankRecDate.fromDate, bankRecDate.toDate, timePeriodOptions]);
+    }, [bankRecDate.fromDate, bankRecDate.toDate, allOptions]);
 
     const handleTimePeriodChange = (fromDate: string, toDate: string) => {
         setBankRecDate({ fromDate, toDate })
+        setValue("")
         setOpen(false)
     }
 
@@ -130,7 +203,9 @@ const BankRecDateFilter = () => {
 
     const direction = useDirection()
 
-
+    const RangeArrow = direction === 'ltr'
+        ? <ChevronRight className='text-[12px] text-ink-gray-5/70' />
+        : <ChevronLeftIcon className='text-[12px] text-ink-gray-5/70' />
 
     return <div className='flex items-center'>
         <Popover open={open} onOpenChange={setOpen}>
@@ -141,30 +216,57 @@ const BankRecDateFilter = () => {
                     size='md'
                     className='rounded-e-none border-e-0'
                     role="combobox">
-                    {timePeriodOptions.find((period) => period.label === timePeriod)?.translatedLabel ?? _(timePeriod)}
+                    {allOptions.find((period) => period.label === timePeriod)?.translatedLabel ?? _(timePeriod)}
 
                     <ChevronDownIcon />
                 </Button>
             </PopoverTrigger>
 
             <PopoverContent className="w-84 p-1" align='start'>
-                <Command>
+                <Command shouldFilter={false}>
 
-                    <CommandInput placeholder="e.g. Last 3 weeks" onValueChange={setValue} value={value} />
-                    <CommandList className='max-h-fit'>
-                        <CommandEmpty className='text-start p-2 hover:bg-surface-gray-1'>
-                            <EmptyState onSelect={handleTimePeriodChange} value={value} />
-                        </CommandEmpty>
-                        {timePeriodOptions.map((period) => (
-                            <CommandItem key={period.label} className='flex justify-between' onSelect={() => handleTimePeriodChange(period.fromDate, period.toDate)}>
-                                <span>
-                                    {period.translatedLabel ?? _(period.label)}
-                                </span>
-                                <span className='text-xs text-ink-gray-5 flex items-center gap-1 text-end whitespace-nowrap'>
-                                    {formatDate(period.fromDate, period.format)} {direction === 'ltr' ? <ChevronRight className='text-[12px] text-ink-gray-5/70' /> : <ChevronLeftIcon className='text-[12px] text-ink-gray-5/70' />} {formatDate(period.toDate, period.format)}
-                                </span>
-                            </CommandItem>
-                        ))}
+                    <CommandInput placeholder={_("e.g. Last 3 weeks, Q1, May 2025")} onValueChange={setValue} value={value} />
+                    <CommandList ref={listRef} className='max-h-80'>
+                        {showParsedOption && parsedOption && (
+                            <CommandGroup heading={_("Matched date")}>
+                                <CommandItem
+                                    value='parsed-date-range'
+                                    className='flex justify-between'
+                                    onSelect={() => handleTimePeriodChange(parsedOption.fromDate, parsedOption.toDate)}>
+                                    <span className='max-w-[45%] truncate'>{value}</span>
+                                    <span className='text-xs text-ink-gray-5 flex items-center gap-1 text-end whitespace-nowrap'>
+                                        {parsedOption.fromDate === parsedOption.toDate
+                                            ? formatDate(parsedOption.fromDate, 'Do MMM YYYY')
+                                            : <>{formatDate(parsedOption.fromDate, 'Do MMM YY')} {RangeArrow} {formatDate(parsedOption.toDate, 'Do MMM YY')}</>}
+                                    </span>
+                                </CommandItem>
+                            </CommandGroup>
+                        )}
+
+                        {filteredOptions.length > 0 && (
+                            <CommandGroup>
+                                {filteredOptions.map((period) => (
+                                    <CommandItem
+                                        key={period.key}
+                                        value={period.key}
+                                        className='flex justify-between'
+                                        onSelect={() => handleTimePeriodChange(period.fromDate, period.toDate)}>
+                                        <span>
+                                            {period.translatedLabel}
+                                        </span>
+                                        <span className='text-xs text-ink-gray-5 flex items-center gap-1 text-end whitespace-nowrap'>
+                                            {formatDate(period.fromDate, period.format)} {RangeArrow} {formatDate(period.toDate, period.format)}
+                                        </span>
+                                    </CommandItem>
+                                ))}
+                            </CommandGroup>
+                        )}
+
+                        {!showParsedOption && filteredOptions.length === 0 && (
+                            <div className='p-2 text-sm text-ink-gray-5'>
+                                {_("No results found")}
+                            </div>
+                        )}
                     </CommandList>
                 </Command>
 
@@ -199,77 +301,97 @@ const BankRecDateFilter = () => {
 }
 
 const referentialKeywords = ["last", "this", "next", "previous"]
-const EmptyState = ({ onSelect, value }: { onSelect: (fromDate: string, toDate: string) => void, value: string }) => {
 
-    const dates = useMemo(() => {
-        if (value) {
-            // Try parsing the value
-            const parsedDate = parse(value, undefined, { forwardDate: false })
+/** chrono exposes `knownValues` on ParsingComponents but doesn't type it publicly. */
+const knownValuesOf = (components: unknown): Record<string, number> =>
+    (components as { knownValues?: Record<string, number> })?.knownValues ?? {}
 
-            if (parsedDate && parsedDate.length > 0) {
-                const startDate = parsedDate[0].start.date()
-                const endDate = parsedDate[0].end?.date()
+/**
+ * How far back a parsed date must move to land in the past. Reconciliation only ever looks
+ * backwards, so an ambiguous input that chrono resolves into the future - "December" typed in
+ * September, or a bare weekday like "Friday" - is pulled to its most recent past occurrence.
+ * An explicitly stated year is respected; a range that is still future gets discarded later.
+ *
+ * This returns a shift rather than a date so that a range can be moved as a single unit -
+ * shifting its start and end independently would distort or invert it.
+ */
+const pastShift = (date: Date, knownValues: Record<string, number>) => {
+    const today = dayjs()
+    let candidate = dayjs(date)
 
-                if (!endDate) {
-                    const today = new Date()
-                    // If today is greater than the start date, use today as the end date
-                    if (startDate.getTime() > today.getTime()) {
-                        return { fromDate: today, toDate: startDate }
-                    } else {
-                        // Check if the user only wants a specific month like "May 2025"
-                        // If the "known values" just has month and year, then we need to get the first day of the month and the last day of the month
-                        // @ts-expect-error - "Known Values" is available in the start "ParsingComponents"
-                        if (parsedDate[0].start.knownValues?.month && !parsedDate[0].start.knownValues?.day) {
-                            return {
-                                fromDate: startDate,
-                                toDate: dayjs(startDate).endOf('month').toDate()
-                            }
-                            // @ts-expect-error - "Known Values" is available in the start "ParsingComponents"
-                        } else if (parsedDate[0].start.knownValues?.month && parsedDate[0].start.knownValues?.day && !referentialKeywords.some(keyword => value.toLowerCase().includes(keyword))) {
-                            // If month and day is known, then we should not assume that the user wants to get everything until today
-                            return {
-                                fromDate: startDate,
-                                toDate: startDate,
-                            }
-                        }
-
-                        return {
-                            fromDate: startDate,
-                            toDate: today
-                        }
-                    }
-                } else {
-                    return { fromDate: startDate, toDate: endDate }
-                }
-            }
-
-        }
-    }, [value])
-
-    const onClick = (fromDate: Date, toDate: Date) => {
-        onSelect(formatDate(fromDate, 'YYYY-MM-DD'), formatDate(toDate, 'YYYY-MM-DD'))
+    if (!candidate.isAfter(today, 'date') || knownValues.year !== undefined) {
+        return { amount: 0, unit: 'year' as const }
     }
 
-    const isEqual = dates?.fromDate && dates?.toDate && dayjs(dates.fromDate).isSame(dates.toDate, 'date')
+    // A bare weekday repeats weekly, everything else (month/day) repeats yearly.
+    const unit = knownValues.weekday !== undefined && knownValues.day === undefined
+        ? 'day' as const
+        : 'year' as const
+    const step = unit === 'day' ? 7 : 1
+    let amount = 0
 
-    return <div>
-        {dates ?
-            <div className='flex gap-2 items-center justify-between cursor-pointer' onClick={() => onClick(dates.fromDate, dates.toDate)}>
-                <span className='text-sm text-ink-gray-5 max-w-[30%]'>
-                    {value}
-                </span>
-                {isEqual ? <span className='text-xs text-ink-gray-5 text-balance flex items-center gap-1'>
-                    {formatDate(dates.fromDate, 'Do MMM YYYY')}
-                </span> :
-                    <span className='text-xs text-ink-gray-5 flex items-center gap-1'>
-                        {formatDate(dates.fromDate, 'Do MMM YY')} <ChevronRight size='16' className='text-ink-gray-5' /> {formatDate(dates.toDate, 'Do MMM YY')}
-                    </span>}
-            </div> :
-            <span className='text-sm text-ink-gray-5'>
-                No results found
-            </span>
-        }
-    </div>
+    for (let i = 0; i < 200 && candidate.isAfter(today, 'date'); i++) {
+        candidate = candidate.subtract(step, unit)
+        amount += step
+    }
+
+    return { amount, unit }
 }
 
-export default BankRecDateFilter
+/**
+ * Parse free text into a past date range, or return undefined when it can't be parsed or
+ * resolves entirely into the future.
+ */
+const parseDateRange = (value: string): { fromDate: string, toDate: string } | undefined => {
+    if (!value.trim()) return undefined
+
+    const parsedDate = parse(value, undefined, { forwardDate: false })
+
+    if (!parsedDate || parsedDate.length === 0) return undefined
+
+    const result = parsedDate[0]
+    const startKnownValues = knownValuesOf(result.start)
+
+    // Anchor the shift on the start and apply it to both ends, so an explicit range like
+    // "1st Sept to 30th Sept" keeps its shape instead of having only its end rolled back.
+    const shift = pastShift(result.start.date(), startKnownValues)
+    const startDate = dayjs(result.start.date()).subtract(shift.amount, shift.unit).toDate()
+    const endDate = result.end
+        ? dayjs(result.end.date()).subtract(shift.amount, shift.unit).toDate()
+        : undefined
+
+    const today = new Date()
+    let range: { fromDate: Date, toDate: Date }
+
+    if (endDate) {
+        const endKnownValues = knownValuesOf(result.end)
+        // chrono ends "Apr 2025 to Jun 2025" on the 1st of June, but the user means all of it.
+        const rangeEnd = endKnownValues.month && !endKnownValues.day
+            ? dayjs(endDate).endOf('month').toDate()
+            : endDate
+        range = { fromDate: startDate, toDate: rangeEnd }
+    } else if (startKnownValues.month && !startKnownValues.day) {
+        // The user only wants a specific month like "May 2025" - span the whole month
+        range = { fromDate: dayjs(startDate).startOf('month').toDate(), toDate: dayjs(startDate).endOf('month').toDate() }
+    } else if (startKnownValues.month && startKnownValues.day && !referentialKeywords.some(keyword => value.toLowerCase().includes(keyword))) {
+        // If month and day is known, then we should not assume that the user wants to get everything until today
+        range = { fromDate: startDate, toDate: startDate }
+    } else {
+        range = { fromDate: startDate, toDate: today }
+    }
+
+    // A range that hasn't started yet is never useful for reconciliation. A range that merely
+    // ends in the future is kept as typed, the same way "This Month" spans the whole month.
+    if (dayjs(range.fromDate).isAfter(today, 'date')) return undefined
+
+    if (dayjs(range.toDate).isBefore(range.fromDate, 'date')) {
+        range = { fromDate: range.toDate, toDate: range.fromDate }
+    }
+
+    return {
+        fromDate: dayjs(range.fromDate).format(DATE_FORMAT),
+        toDate: dayjs(range.toDate).format(DATE_FORMAT),
+    }
+}
+
+export default BankRecDateFilter

banking/src/components/features/BankReconciliation/BankReconciliationStatement.tsx

@@ -191,9 +191,9 @@ const BankReconciliationStatementView = () => {
 
     const content = _("Below is a list of all entries posted against the bank account {0} which have not been cleared till {1}.", [`<strong>${bankAccount?.account}</strong>`, `<strong>${formatDate(dates.toDate)}</strong>`])
 
-    return <div className="space-y-4 py-2">
+    return <div className="flex min-h-0 flex-1 flex-col space-y-4 py-2">
 
-        <div>
+        <div className="shrink-0">
             <span className="text-p-sm">
                 <MarkdownRenderer content={content} />
             </span>
@@ -201,16 +201,18 @@ const BankReconciliationStatementView = () => {
 
         {error && <ErrorBanner error={error} />}
 
-        {data && <SummarySection data={data} />}
+        {data && <div className="shrink-0"><SummarySection data={data} /></div>}
 
         {data && data.message.result.length > 0 && (
-            <div className="space-y-2">
-                <p className="text-ink-gray-5 text-sm">{_("Bank Reconciliation Statement")}</p>
+            <div className="flex min-h-0 flex-1 flex-col space-y-2">
+                <p className="shrink-0 text-ink-gray-5 text-sm">{_("Bank Reconciliation Statement")}</p>
                 <ListView
                     data={statementRows}
                     columns={statementColumns}
                     getRowId={(row) => row.payment_entry}
-                    maxHeight="min(70vh, 640px)"
+                    className="min-h-0 flex-1"
+                    maxHeight="none"
+                    scrollAreaClassName="flex-1"
                     emptyState={_("No entries with a payment document in this list.")}
                 />
             </div>

banking/src/components/features/BankReconciliation/BankTransactionList.tsx

@@ -245,9 +245,9 @@ const BankTransactionListView = () => {
 
     const content = _("Below is a list of all bank transactions imported in the system for the bank account {0} between {1} and {2}.", [`<strong>${bankAccount?.account_name}</strong>`, `<strong>${formattedFromDate}</strong>`, `<strong>${formattedToDate}</strong>`])
 
-    return <div className="space-y-2 py-2">
+    return <div className="flex min-h-0 flex-1 flex-col space-y-2 py-2">
 
-        <div className="flex gap-2 justify-between items-center">
+        <div className="flex shrink-0 gap-2 justify-between items-center">
             <span className="text-p-sm">
                 <MarkdownRenderer content={content} />
             </span>
@@ -278,8 +278,9 @@ const BankTransactionListView = () => {
             data={filteredResults}
             columns={transactionColumns}
             getRowId={(row) => row.name}
-            maxHeight="calc(100vh - 200px)"
-            scrollAreaClassName="min-h-[calc(100vh-200px)]"
+            className="min-h-0 flex-1"
+            maxHeight="none"
+            scrollAreaClassName="flex-1"
             emptyState={<Empty>
                 <EmptyMedia>
                     <ListIcon />

banking/src/components/features/BankReconciliation/IncorrectlyClearedEntries.tsx

@@ -181,9 +181,9 @@ const IncorrectlyClearedEntriesView = () => {
 
     const entriesContent = _("Entries below have a posting date after {0} but the clearance date is before {1}.", [`<strong>${formattedToDate}</strong>`, `<strong>${formattedToDate}</strong>`])
 
-    return <div className="space-y-4 py-2">
+    return <div className="flex min-h-0 flex-1 flex-col space-y-4 py-2">
 
-        <div>
+        <div className="shrink-0">
             <span className="text-p-sm">
                 <MarkdownRenderer content={content} />
                 <br />
@@ -198,13 +198,15 @@ const IncorrectlyClearedEntriesView = () => {
         {error && <ErrorBanner error={error} />}
 
         {data && data.message.result.length > 0 && (
-            <div className="space-y-2">
-                <p className="text-ink-gray-5 text-sm">{_("Incorrectly cleared entries as per the report.")}</p>
+            <div className="flex min-h-0 flex-1 flex-col space-y-2">
+                <p className="shrink-0 text-ink-gray-5 text-sm">{_("Incorrectly cleared entries as per the report.")}</p>
                 <ListView
                     data={data.message.result}
                     columns={incorrectlyClearedColumns}
                     getRowId={(row) => `${row.payment_entry}-${row.posting_date}`}
-                    maxHeight="min(70vh, 640px)"
+                    className="min-h-0 flex-1"
+                    maxHeight="none"
+                    scrollAreaClassName="flex-1"
                     emptyState={_("No rows to display.")}
                 />
             </div>

banking/src/components/features/BankReconciliation/MatchAndReconcile.tsx

@@ -37,7 +37,7 @@ import { Link } from "react-router"
 import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert"
 import { InputGroup, InputGroupAddon, InputGroupText } from "@/components/ui/input-group"
 
-const MatchAndReconcile = ({ contentHeight }: { contentHeight: number }) => {
+const MatchAndReconcile = () => {
     const selectedBank = useAtomValue(selectedBankAccountAtom)
 
     if (!selectedBank) {
@@ -52,15 +52,15 @@ const MatchAndReconcile = ({ contentHeight }: { contentHeight: number }) => {
     }
 
     return <>
-        <div className={`flex items-start space-x-2`} >
-            <div className="flex-1">
-                <H4 className="text-sm font-medium">{_("Unreconciled Transactions")}</H4>
-                <UnreconciledTransactions contentHeight={contentHeight} />
+        <div className="flex min-h-0 flex-1 items-stretch space-x-2" >
+            <div className="flex min-h-0 flex-1 flex-col">
+                <H4 className="shrink-0 text-sm font-medium">{_("Unreconciled Transactions")}</H4>
+                <UnreconciledTransactions />
             </div>
-            <Separator orientation="vertical" style={{ minHeight: `${contentHeight}px` }} />
-            <div className="flex-1 px-1">
-                <H4 className="text-sm font-medium">{_("Match or Create")}</H4>
-                <VouchersSection contentHeight={contentHeight} />
+            <Separator orientation="vertical" className="self-stretch" />
+            <div className="flex min-h-0 flex-1 flex-col px-1">
+                <H4 className="shrink-0 text-sm font-medium">{_("Match or Create")}</H4>
+                <VouchersSection />
             </div>
         </div>
         <TransferModal />
@@ -69,16 +69,19 @@ const MatchAndReconcile = ({ contentHeight }: { contentHeight: number }) => {
     </>
 }
 
-/** TanStack requires `estimateSize` for initial scroll range; `measureElement` on each row sets the real height. */
+/**
+ * TanStack requires `estimateSize` for initial scroll range; `measureElement` on each row sets
+ * the real height. The scroll container fills its flex parent rather than taking a pixel
+ * height - the virtualizer observes its own rect, so it stays correct across resizes and any
+ * layout change above it.
+ */
 function VirtualizedListBody<T>({
     items,
-    height,
     getItemKey,
     children,
     estimateSize = 74,
 }: {
     items: T[]
-    height: number
     getItemKey: (item: T, index: number) => string | number
     children: (item: T, index: number) => React.ReactNode
     estimateSize?: number
@@ -100,8 +103,7 @@ function VirtualizedListBody<T>({
     return (
         <div
             ref={scrollRef}
-            className="overflow-auto contain-strict"
-            style={{ height }}
+            className="min-h-0 flex-1 overflow-auto contain-strict"
         >
             <div
                 className="relative w-full"
@@ -123,7 +125,7 @@ function VirtualizedListBody<T>({
     )
 }
 
-const UnreconciledTransactions = ({ contentHeight }: { contentHeight: number }) => {
+const UnreconciledTransactions = () => {
     const bankAccount = useAtomValue(selectedBankAccountAtom)
 
     const currency = bankAccount?.account_currency ?? getCompanyCurrency(bankAccount?.company ?? '')
@@ -187,14 +189,13 @@ const UnreconciledTransactions = ({ contentHeight }: { contentHeight: number })
     }
 
     const hasFilters = search !== '' || typeFilter !== 'All' || amountFilter.value !== 0
-    const listHeight = contentHeight - 72
 
     if (isLoading) {
         return <UnreconciledTransactionsLoadingState />
     }
 
-    return <div className="space-y-1">
-        <div className="flex py-2 w-full gap-2">
+    return <div className="flex min-h-0 flex-1 flex-col space-y-1">
+        <div className="flex py-2 w-full gap-2 shrink-0">
 
             <InputGroup variant='outline'>
                 <label className="sr-only">{_("Search transactions")}</label>
@@ -278,7 +279,6 @@ const UnreconciledTransactions = ({ contentHeight }: { contentHeight: number })
 
         <VirtualizedListBody
             items={results}
-            height={listHeight}
             estimateSize={74}
             getItemKey={(transaction) => transaction.name}
         >
@@ -381,7 +381,7 @@ const UnreconciledTransactionItem = ({ transaction }: { transaction: Unreconcile
 }
 
 
-const VouchersSection = ({ contentHeight }: { contentHeight: number }) => {
+const VouchersSection = () => {
 
     const selectedBank = useAtomValue(selectedBankAccountAtom)
     const selectedTransactions = useAtomValue(bankRecSelectedTransactionAtom(selectedBank?.name || ''))
@@ -402,8 +402,8 @@ const VouchersSection = ({ contentHeight }: { contentHeight: number }) => {
         return <OptionsForMultipleTransactions transactions={selectedTransactions} />
     }
 
-    return <div style={{ minHeight: contentHeight }} className="mt-2">
-        <OptionsForSingleTransaction transaction={selectedTransactions[0]} contentHeight={contentHeight} />
+    return <div className="mt-2 flex min-h-0 flex-1 flex-col">
+        <OptionsForSingleTransaction transaction={selectedTransactions[0]} />
     </div>
 }
 
@@ -535,11 +535,11 @@ const OptionsForMultipleTransactions = ({ transactions }: { transactions: Unreco
 }
 
 
-const OptionsForSingleTransaction = ({ transaction, contentHeight }: { transaction: UnreconciledTransaction, contentHeight: number }) => {
+const OptionsForSingleTransaction = ({ transaction }: { transaction: UnreconciledTransaction }) => {
 
     const { setTransferModalOpen, setRecordPaymentModalOpen, setRecordJournalEntryModalOpen } = useKeyboardShortcuts()
 
-    return <div className="flex flex-col gap-3">
+    return <div className="flex min-h-0 flex-1 flex-col gap-3">
         <TooltipProvider>
             <div className="flex items-center justify-between pt-2">
                 <div className="flex gap-4 justify-center">
@@ -602,7 +602,7 @@ const OptionsForSingleTransaction = ({ transaction, contentHeight }: { transacti
             </div>
         </TooltipProvider>
         {transaction.matched_transaction_rule && <RuleAction transaction={transaction} />}
-        <VouchersForTransaction transaction={transaction} contentHeight={contentHeight} />
+        <VouchersForTransaction transaction={transaction} />
     </div>
 }
 
@@ -774,12 +774,11 @@ const RuleAction = ({ transaction }: { transaction: UnreconciledTransaction }) =
     )
 }
 
-const VouchersForTransaction = ({ transaction, contentHeight }: { transaction: UnreconciledTransaction, contentHeight: number }) => {
+const VouchersForTransaction = ({ transaction }: { transaction: UnreconciledTransaction }) => {
 
     const { data: vouchers, isLoading, error } = useGetVouchersForTransaction(transaction)
 
     const voucherList = vouchers?.message ?? []
-    const listHeight = contentHeight - 120
 
     if (error) {
         return <ErrorBanner error={error} />
@@ -801,8 +800,8 @@ const VouchersForTransaction = ({ transaction, contentHeight }: { transaction: U
         </div>
     }
 
-    return <div className="relative space-y-2">
-        <div className="flex items-center gap-2 text-sm text-ink-gray-5">
+    return <div className="relative flex min-h-0 flex-1 flex-col space-y-2">
+        <div className="flex shrink-0 items-center gap-2 text-sm text-ink-gray-5">
             <Separator className="flex-1" />
             <span>or</span>
             <Separator className="flex-1" />
@@ -818,7 +817,6 @@ const VouchersForTransaction = ({ transaction, contentHeight }: { transaction: U
         </Empty>}
         <VirtualizedListBody
             items={voucherList}
-            height={listHeight}
             estimateSize={121}
             getItemKey={(voucher) => voucher.name}
         >

banking/src/components/features/BankReconciliation/SelectedTransactionDetails.tsx

@@ -59,8 +59,8 @@ const SelectedTransactionDetails = ({ transaction, showAccount = false, account
                         </div>
                     </div>
                     <div className='flex flex-col gap-1'>
-                        <span className='text-sm'>{transaction.description}</span>
-                        {transaction.reference_number ? <span className='text-sm text-ink-gray-5'>{_("Ref")}: {transaction.reference_number}</span> : null}
+                        <span className='text-p-sm'>{transaction.description}</span>
+                        {transaction.reference_number ? <span className='text-p-sm text-ink-gray-5'>{_("Ref")}: {transaction.reference_number}</span> : null}
                         {showAccount && account ? <span className='text-sm text-ink-gray-5'>{_("GL Account")}: {account}</span> : null}
                     </div>
 

banking/src/components/features/BankReconciliation/TransferModalContent.tsx

@@ -490,7 +490,7 @@ const RecommendedTransferAccount = ({ transaction, onAccountChange }: { transact
                                 <Calendar size='16px' />
                                 <span className='text-sm'>{formatDate(data.message.date, 'Do MMM YYYY')}</span>
                             </div>
-                            <span className='text-sm line-clamp-1' title={data.message.description}>{data.message.description}</span>
+                            <span className='text-p-sm line-clamp-1' title={data.message.description}>{data.message.description}</span>
                         </div>
                     </div>
                 </div>

banking/src/components/features/BankReconciliation/logos.ts

@@ -231,7 +231,7 @@ export const BANK_LOGOS: { keywords: string[], logo: string, locale?: string[],
     {
         keywords: ['Federal Bank'],
         logo: 'Federal_Bank.png',
-        logoDark: 'Federal_Bank-dark.png',
+        logoDark: 'Federal_Bank-Dark.png',
         locale: ['India']
     },
     {

banking/src/components/features/BankStatementImporter/CSV/StatementDetails.tsx

@@ -83,10 +83,13 @@ const StatementDetails = ({ data }: Props) => {
 
     }
 
+    // `progress` is a percentage (drives the bar); `current`/`total` are actual counts.
     const [progress, setProgress] = useState(0)
+    const [imported, setImported] = useState({ current: 0, total: 0 })
 
     useFrappeEventListener("bank-rec-statement-import-progress", (event) => {
         setProgress(event.progress)
+        setImported({ current: event.current ?? 0, total: event.total ?? 0 })
     })
 
     const file_name = data.doc.file.split("/").pop() ?? ""
@@ -112,7 +115,9 @@ const StatementDetails = ({ data }: Props) => {
                     {data.doc.status === 'Completed' ? <Badge theme='green'>{_("Completed")}</Badge> :
                         <Button onClick={onImport} disabled={loading || data.final_transactions?.length === 0} size='sm' type='button'>
                             {loading ? <Loader2Icon className='size-4 animate-spin' /> : null}
-                            {loading ? _("Importing...") : _("Import {0} transactions", [data.final_transactions?.length?.toString() || "0"])}</Button>
+                            {loading ? _("Importing...") : data.final_transactions?.length === 1
+                                ? _("Import 1 transaction")
+                                : _("Import {0} transactions", [data.final_transactions?.length?.toString() || "0"])}</Button>
                     }
                 </div>
                 <div className='flex items-start gap-4'>
@@ -129,7 +134,9 @@ const StatementDetails = ({ data }: Props) => {
                 </div>
 
                 {progress > 0 && <div className='flex flex-col gap-2'><Progress value={progress} max={100} size="lg" />
-                    <span className='text-sm'>{_("Importing {0} transactions", [progress.toString()])}
+                    <span className='text-sm'>{imported.total === 1
+                        ? _("Importing 1 transaction")
+                        : _("Importing {0} of {1} transactions", [imported.current.toString(), imported.total.toString()])}
                     </span>
                 </div>}
 

banking/src/components/ui/list-view.tsx

@@ -387,7 +387,7 @@ function ListViewInner<TData>({
                                     )}
                                     role="columnheader"
                                 >
-                                    <div className="min-w-0 flex-1 truncate">
+                                    <div className="min-w-0 flex-1 truncate leading-snug">
                                         {header.isPlaceholder
                                             ? null
                                             : flexRender(header.column.columnDef.header, header.getContext())}

banking/src/hooks/useFiscalYear.ts

@@ -1,13 +1,58 @@
 import { useFrappeGetCall } from "frappe-react-sdk"
+import { useMemo } from "react"
+import dayjs from "dayjs"
+import { useCurrentCompany } from "./useCurrentCompany"
 
-const useFiscalYear = () => {
-
-    return useFrappeGetCall("erpnext.accounts.utils.get_fiscal_year", undefined, 'fiscal_year', {
-        revalidateOnFocus: false,
-        revalidateIfStale: false,
-        revalidateOnReconnect: false
-    })
-
+export type FiscalYear = {
+    name: string
+    year_start_date: string
+    year_end_date: string
 }
 
-export default useFiscalYear
+/**
+ * The fiscal year containing today, for the currently selected company.
+ *
+ * `company` matters in multi-company setups, where fiscal years can be restricted to
+ * specific companies. `date` matters because without it `get_fiscal_year` returns the newest
+ * fiscal year in the system (they're ordered by start date, descending) - which may be one
+ * created in advance for a year that hasn't started.
+ */
+const useFiscalYear = () => {
+    const company = useCurrentCompany()
+
+    const { data, ...rest } = useFrappeGetCall<{ message: FiscalYear | [string, string, string] | false }>(
+        "erpnext.accounts.utils.get_fiscal_year",
+        {
+            date: dayjs().format("YYYY-MM-DD"),
+            company,
+            as_dict: 1,
+            // Return nothing instead of throwing/msgprinting when no fiscal year covers today.
+            raise_on_missing: 0,
+            verbose: 0,
+        },
+        company ? `fiscal_year_${company}` : null,
+        {
+            revalidateOnFocus: false,
+            revalidateIfStale: false,
+            revalidateOnReconnect: false
+        }
+    )
+
+    // get_fiscal_year returns a dict with as_dict, a (name, start, end) tuple without it, and
+    // false when there's no match - normalise all three.
+    const fiscalYear = useMemo<FiscalYear | undefined>(() => {
+        const message = data?.message
+        if (!message) return undefined
+
+        if (Array.isArray(message)) {
+            const [name, year_start_date, year_end_date] = message
+            return { name, year_start_date, year_end_date }
+        }
+
+        return message
+    }, [data])
+
+    return { fiscalYear, ...rest }
+}
+
+export default useFiscalYear

banking/src/hooks/useResetScrollOnSearch.ts

@@ -0,0 +1,23 @@
+import { useLayoutEffect, useRef } from "react"
+
+/**
+ * Pins a scrollable list back to the top whenever the search term changes.
+ *
+ * Dropdowns that do their own filtering (`shouldFilter={false}`) swap a long list for a much
+ * shorter one while the scroll container keeps its previous offset - which can leave the
+ * auto-selected first item scrolled out of view.
+ *
+ * Returns a ref to attach to the scroll container (e.g. `CommandList`).
+ */
+const useResetScrollOnSearch = (search: string) => {
+    const listRef = useRef<HTMLDivElement>(null)
+
+    // Layout effect so the reset lands before paint, avoiding a visible jump.
+    useLayoutEffect(() => {
+        listRef.current?.scrollTo({ top: 0 })
+    }, [search])
+
+    return listRef
+}
+
+export default useResetScrollOnSearch

banking/src/index.css

@@ -1,5 +1,6 @@
 @import "tailwindcss";
 @import "tw-animate-css";
+@import "./styles/scroll-fade.css";
 
 @font-face {
   font-family: InterVariable;

banking/src/pages/BankReconciliation.tsx

@@ -1,4 +1,4 @@
-import BankBalance from "@/components/features/BankReconciliation/BankBalance"
+import BankAccountBalancePanel from "@/components/features/BankReconciliation/BankBalance"
 import BankPicker from "@/components/features/BankReconciliation/BankPicker"
 import BankRecDateFilter from "@/components/features/BankReconciliation/BankRecDateFilter"
 import BankTransactionUnreconcileModal from "@/components/features/BankReconciliation/BankTransactionUnreconcileModal"
@@ -9,10 +9,9 @@ import ActionLog from "@/components/features/ActionLog/ActionLog"
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
 import { TooltipProvider } from "@/components/ui/tooltip"
 import _ from "@/lib/translate"
-import { lazy, Suspense, useLayoutEffect, useRef, useState } from "react"
+import { lazy, Suspense } from "react"
 import { AlertTriangleIcon, CheckCircleIcon, HomeIcon, LandmarkIcon, ListIcon, Loader2Icon, ScrollTextIcon, ShuffleIcon } from "lucide-react"
 import { Breadcrumb, BreadcrumbItem, BreadcrumbList, BreadcrumbPage, BreadcrumbSeparator } from "@/components/ui/breadcrumb"
-import { Badge } from "@/components/ui/badge"
 import { Empty, EmptyContent, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from "@/components/ui/empty"
 import { Button } from "@/components/ui/button"
 import { useAtomValue } from "jotai"
@@ -25,23 +24,13 @@ const IncorrectlyClearedEntries = lazy(() => import('@/components/features/BankR
 
 const BankReconciliation = () => {
 
-    const [headerHeight, setHeaderHeight] = useState(0)
-
-    const ref = useRef<HTMLDivElement>(null)
-
-    useLayoutEffect(() => {
-        if (ref.current) {
-            setHeaderHeight(ref.current.clientHeight)
-        }
-    }, [])
-
-    const remainingHeightAfterTabs = window.innerHeight - headerHeight - 220
-
     return (
         <div>
-            <div className="p-4 flex-col gap-4 md:flex hidden">
-                <div ref={ref} className="flex flex-col gap-4">
-                    <div className="flex justify-between">
+            {/* The page owns the viewport height and the tabs/lists below fill what's left, so
+                the virtualizers size themselves from layout instead of a measured pixel value. */}
+            <div className="px-2 pt-1 flex-col gap-4 md:flex hidden h-dvh">
+                <div className="flex flex-col gap-4 shrink-0">
+                    <div className="flex justify-between shrink-0">
                         <div className="flex items-center gap-6">
                             <Breadcrumb>
                                 <BreadcrumbList>
@@ -54,7 +43,7 @@ const BankReconciliation = () => {
                                     <BreadcrumbItem>
                                         <BreadcrumbPage>
                                             <div className="flex gap-1 items-center">
-                                                {_("Banking")} <Badge theme="violet" variant="subtle">{_("Beta")}</Badge>
+                                                {_("Banking")}
                                             </div>
 
                                         </BreadcrumbPage>
@@ -71,10 +60,8 @@ const BankReconciliation = () => {
                             <BankRecDateFilter />
                         </div>
                     </div>
-                    <BankPicker />
-                    <BankBalance />
                 </div>
-                <BankRecTabs remainingHeightAfterTabs={remainingHeightAfterTabs} />
+                <BankRecWorkspace />
                 <BankTransactionUnreconcileModal />
             </div>
             <div className="md:hidden flex h-screen items-center justify-between">
@@ -104,42 +91,53 @@ const BankReconciliation = () => {
     )
 }
 
-const BankRecTabs = ({ remainingHeightAfterTabs }: { remainingHeightAfterTabs: number }) => {
+const BankRecWorkspace = () => {
     const selectedBankAccount = useAtomValue(selectedBankAccountAtom)
 
-    if (!selectedBankAccount) {
-        return null
-    }
-
-    return <Tabs defaultValue="Match and Reconcile">
-        <TabsList>
-            <TabsTrigger value="Match and Reconcile"><ShuffleIcon /> {_("Match and Reconcile")}</TabsTrigger>
-            <TabsTrigger value="Bank Reconciliation Statement"><ScrollTextIcon /> {_("Bank Reconciliation Statement")}</TabsTrigger>
-            <TabsTrigger value="Bank Transactions"><ListIcon />{_("Bank Transactions")}</TabsTrigger>
-            <TabsTrigger value="Bank Clearance Summary"><CheckCircleIcon />{_("Bank Clearance Summary")}</TabsTrigger>
-            <TabsTrigger value="Incorrectly Cleared Entries"><AlertTriangleIcon /> {_("Incorrectly Cleared Entries")}</TabsTrigger>
-        </TabsList>
-        <TabsContent value="Match and Reconcile">
-            <MatchAndReconcile contentHeight={remainingHeightAfterTabs} />
-        </TabsContent>
-        <Suspense fallback={
-            <div className="flex items-center justify-center p-16">
-                <Loader2Icon className="size-6 animate-spin text-muted-foreground" />
+    return <Tabs defaultValue="Match and Reconcile" className="min-h-0 flex-1 gap-4">
+        {/* Picker + tab strip stack on the left, balance panel beside them - the tab strip
+            fills height the panel needs anyway, so it costs no row of its own. The picker
+            scrolls horizontally (`min-w-0` lets it shrink so its overflow-x engages) while
+            the panel stays put, so the figures never scroll away. */}
+        {/* No gap here: the panel's own `border-s ps-4` supplies the separation, and a gap
+            would leave dead space the picker's edge fade can't reach. */}
+        <div className="flex shrink-0 items-stretch">
+            <div className="flex min-w-0 flex-1 flex-col justify-between gap-3">
+                <BankPicker />
+                {selectedBankAccount && <TabsList>
+                    <TabsTrigger value="Match and Reconcile"><ShuffleIcon /> {_("Match and Reconcile")}</TabsTrigger>
+                    <TabsTrigger value="Bank Reconciliation Statement"><ScrollTextIcon /> {_("Reconciliation Statement")}</TabsTrigger>
+                    <TabsTrigger value="Bank Transactions"><ListIcon />{_("Transactions")}</TabsTrigger>
+                    <TabsTrigger value="Bank Clearance Summary"><CheckCircleIcon />{_("Clearance Summary")}</TabsTrigger>
+                    <TabsTrigger value="Incorrectly Cleared Entries"><AlertTriangleIcon /> {_("Incorrectly Cleared")}</TabsTrigger>
+                </TabsList>}
             </div>
-        }>
-            <TabsContent value="Bank Reconciliation Statement">
-                <BankReconciliationStatement />
+            {selectedBankAccount && <BankAccountBalancePanel />}
+        </div>
+
+        {selectedBankAccount && <>
+            <TabsContent value="Match and Reconcile" className="flex min-h-0 flex-col">
+                <MatchAndReconcile />
             </TabsContent>
-            <TabsContent value="Bank Transactions">
-                <BankTransactions />
-            </TabsContent>
-            <TabsContent value="Bank Clearance Summary">
-                <BankClearanceSummary />
-            </TabsContent>
-            <TabsContent value="Incorrectly Cleared Entries">
-                <IncorrectlyClearedEntries />
-            </TabsContent>
-        </Suspense>
+            <Suspense fallback={
+                <div className="flex items-center justify-center p-16">
+                    <Loader2Icon className="size-6 animate-spin text-muted-foreground" />
+                </div>
+            }>
+                <TabsContent value="Bank Reconciliation Statement" className="flex min-h-0 flex-col">
+                    <BankReconciliationStatement />
+                </TabsContent>
+                <TabsContent value="Bank Transactions" className="flex min-h-0 flex-col">
+                    <BankTransactions />
+                </TabsContent>
+                <TabsContent value="Bank Clearance Summary" className="flex min-h-0 flex-col">
+                    <BankClearanceSummary />
+                </TabsContent>
+                <TabsContent value="Incorrectly Cleared Entries" className="flex min-h-0 flex-col">
+                    <IncorrectlyClearedEntries />
+                </TabsContent>
+            </Suspense>
+        </>}
     </Tabs>
 }
 

banking/src/pages/BankStatementImporter.tsx

@@ -226,7 +226,7 @@ const StatementImportLog = () => {
             field: "creation",
             order: "desc"
         },
-        limit: 10
+        limit: 20
     }, bankAccount ? undefined : null, {
         revalidateOnFocus: false
     })

banking/src/styles/scroll-fade.css

@@ -0,0 +1,94 @@
+/* Scroll-edge fade mask for horizontal scroll containers (the bank picker strip).
+   Ported from Raven's `scroll-fade-x`; imported by index.css, since Tailwind processes
+   `@utility` in imported files the same as in the entry file.
+
+   The scroll-timeline keyframes reveal each edge's fade only when there IS content to scroll
+   in that direction - no fade on the left edge when scrolled fully left, none on the right at
+   the end. `@property` makes the fade animate smoothly rather than jumping.
+
+   Without scroll-timeline support (Firefox) there is deliberately NO fade at all: the fade
+   vars stay at their 0px initial value and the gradient stops collapse to the edges. A static
+   both-edges fallback was tried in Raven and removed - on a container with nothing to scroll
+   it dimmed the edges anyway, promising content that didn't exist. */
+
+@property --scroll-fade-l {
+  /* length-percentage, NOT length: the fade size is min(12%, …) - a percentage. A <length>
+     property rejects that value and reverts to initial-value (0px), zeroing the fade. */
+  syntax: "<length-percentage>";
+  inherits: false;
+  initial-value: 0px;
+}
+
+@property --scroll-fade-r {
+  syntax: "<length-percentage>";
+  inherits: false;
+  initial-value: 0px;
+}
+
+@keyframes scroll-fade-reveal-l {
+  from {
+    --scroll-fade-l: 0px;
+  }
+
+  to {
+    --scroll-fade-l: var(--_scroll-fade-size-l);
+  }
+}
+
+@keyframes scroll-fade-reveal-r {
+  from {
+    --scroll-fade-r: var(--_scroll-fade-size-r);
+  }
+
+  to {
+    --scroll-fade-r: 0px;
+  }
+}
+
+@utility scroll-fade-x {
+  --_scroll-fade-size-l: var(--scroll-fade-l-size,
+      var(--scroll-fade-size, min(12%, calc(var(--spacing, 0.25rem) * 10))));
+  --_scroll-fade-size-r: var(--scroll-fade-r-size,
+      var(--scroll-fade-size, min(12%, calc(var(--spacing, 0.25rem) * 10))));
+  /* Eased (smoothstep) alpha ramp, sampled finely so it reads as a smooth curve, NOT fading
+     all the way to transparent: the edge floors at 0.25 (content dims, never vanishes), ramping
+     up to a full 1 for the body. The opaque end MUST be 1 or everything would be permanently
+     dimmed. Stops collapse to the edge when the size animates to 0, so the true first/last card
+     is never dimmed at rest. Tune the floor - higher (~0.4) = subtler, lower (~0.1) = stronger. */
+  --scroll-fade-inline: linear-gradient(to right,
+      rgba(0, 0, 0, 0.25) 0,
+      rgba(0, 0, 0, 0.282) calc(var(--scroll-fade-l, 0px) * 0.125),
+      rgba(0, 0, 0, 0.367) calc(var(--scroll-fade-l, 0px) * 0.25),
+      rgba(0, 0, 0, 0.487) calc(var(--scroll-fade-l, 0px) * 0.375),
+      rgba(0, 0, 0, 0.625) calc(var(--scroll-fade-l, 0px) * 0.5),
+      rgba(0, 0, 0, 0.763) calc(var(--scroll-fade-l, 0px) * 0.625),
+      rgba(0, 0, 0, 0.883) calc(var(--scroll-fade-l, 0px) * 0.75),
+      rgba(0, 0, 0, 0.968) calc(var(--scroll-fade-l, 0px) * 0.875),
+      rgba(0, 0, 0, 1) var(--scroll-fade-l, 0px),
+      rgba(0, 0, 0, 1) calc(100% - var(--scroll-fade-r, 0px)),
+      rgba(0, 0, 0, 0.968) calc(100% - var(--scroll-fade-r, 0px) * 0.875),
+      rgba(0, 0, 0, 0.883) calc(100% - var(--scroll-fade-r, 0px) * 0.75),
+      rgba(0, 0, 0, 0.763) calc(100% - var(--scroll-fade-r, 0px) * 0.625),
+      rgba(0, 0, 0, 0.625) calc(100% - var(--scroll-fade-r, 0px) * 0.5),
+      rgba(0, 0, 0, 0.487) calc(100% - var(--scroll-fade-r, 0px) * 0.375),
+      rgba(0, 0, 0, 0.367) calc(100% - var(--scroll-fade-r, 0px) * 0.25),
+      rgba(0, 0, 0, 0.282) calc(100% - var(--scroll-fade-r, 0px) * 0.125),
+      rgba(0, 0, 0, 0.25) 100%);
+  -webkit-mask-image: var(--scroll-fade-mask, var(--scroll-fade-inline));
+  mask-image: var(--scroll-fade-mask, var(--scroll-fade-inline));
+  -webkit-mask-composite: source-in;
+  mask-composite: intersect;
+  -webkit-mask-repeat: no-repeat;
+  mask-repeat: no-repeat;
+
+  @supports (animation-timeline: scroll()) {
+    animation:
+      scroll-fade-reveal-l 1ms ease-in-out,
+      scroll-fade-reveal-r 1ms ease-in-out;
+    animation-timeline: scroll(self x), scroll(self x);
+    animation-range:
+      0 var(--scroll-fade-reveal, calc(var(--spacing, 0.25rem) * 24)),
+      calc(100% - var(--scroll-fade-reveal, calc(var(--spacing, 0.25rem) * 24))) 100%;
+    animation-fill-mode: both;
+  }
+}

crowdin.yml

@@ -1,14 +1,5 @@
+preserve_hierarchy: true
+
 files:
   - source: /erpnext/locale/main.pot
     translation: /erpnext/locale/%two_letters_code%.po
-pull_request_title: "fix: sync translations from crowdin"
-pull_request_labels:
-  - translation
-  - skip-release-notes
-pull_request_reviewers:
-  - barredterra # change to your GitHub username if you copied this file
-commit_message: "fix: %language% translations"
-append_commit_message: false
-languages_mapping:
-  two_letters_code:
-    pt-BR: pt_BR

erpnext/__init__.py

@@ -6,7 +6,7 @@ import frappe
 from frappe.model.document import Document
 from frappe.utils.user import is_website_user
 
-__version__ = "16.26.2"
+__version__ = "16.36.0"
 
 
 def get_default_company(user=None):
@@ -177,7 +177,12 @@ def normalize_ctx_input(T: type) -> callable:
 
 	def decorator(func: callable):
 		# conserve annotations for frappe.utils.typing_validations
-		@functools.wraps(func, assigned=(a for a in functools.WRAPPER_ASSIGNMENTS if a != "__annotations__"))
+		@functools.wraps(
+			func,
+			assigned=(
+				a for a in functools.WRAPPER_ASSIGNMENTS if a not in ("__annotations__", "__annotate__")
+			),
+		)
 		def wrapper(ctx: T | Document | dict | str, *args, **kwargs):
 			if isinstance(ctx, Document):
 				ctx = T(**ctx.as_dict())

erpnext/accounts/custom/address.py

@@ -55,6 +55,9 @@ class ERPNextAddress(Address):
 
 @frappe.whitelist()
 def get_shipping_address(company, address=None):
+	# `select`, not `read`: Delivery, Maintenance, Purchase and Stock Manager fill in forms that ask
+	# for this while holding no Company `read` row. doc= so User Permissions apply to the named company.
+	frappe.has_permission("Company", ptype="select", doc=company, throw=True)
 	filters = [
 		["Dynamic Link", "link_doctype", "=", "Company"],
 		["Dynamic Link", "link_name", "=", company],

erpnext/accounts/dashboard_chart/profit_and_loss/profit_and_loss.json

@@ -9,7 +9,7 @@
  "idx": 0,
  "is_public": 1,
  "is_standard": 1,
- "modified": "2025-12-19 12:37:31.673782",
+ "modified": "2026-09-04 12:37:31.673782",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Profit and Loss",
@@ -17,7 +17,6 @@
  "owner": "Administrator",
  "report_name": "Profit and Loss Statement",
  "roles": [],
- "show_values_over_chart": 1,
  "timeseries": 0,
  "type": "Line",
  "use_report_chart": 1,

erpnext/accounts/dashboard_chart_source/account_balance_timeline/account_balance_timeline.py

@@ -24,7 +24,7 @@ def get(
 	heatmap_year=None,
 ):
 	if chart_name:
-		chart = frappe.get_doc("Dashboard Chart", chart_name)
+		chart = frappe.get_doc("Dashboard Chart", chart_name, check_permission="read")
 	else:
 		chart = frappe._dict(frappe.parse_json(chart))
 	timespan = chart.timespan
@@ -53,6 +53,9 @@ def get(
 			)
 		)
 
+	# authorise the account itself, as get_balance_on() does; doc= brings User Permissions with it
+	frappe.has_permission("Account", doc=account, throw=True)
+
 	if not to_date:
 		to_date = nowdate()
 	if not from_date:

erpnext/accounts/doctype/account/account.json

@@ -203,7 +203,7 @@
  "idx": 1,
  "is_tree": 1,
  "links": [],
- "modified": "2026-04-14 18:14:42.202065",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Account",
@@ -264,6 +264,46 @@
   {
    "role": "HR Manager",
    "select": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/account/account.py

@@ -503,12 +503,19 @@ class Account(NestedSet):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_parent_account(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		"""select name from tabAccount
-		where is_group = 1 and docstatus != 2 and company = {}
-		and {} like {} order by name limit {} offset {}""".format("%s", searchfield, "%s", "%s", "%s"),
-		(filters["company"], "%%%s%%" % txt, page_len, start),
-		as_list=1,
+	return frappe.get_list(
+		"Account",
+		filters=[
+			["is_group", "=", 1],
+			["docstatus", "!=", 2],
+			["company", "=", filters["company"]],
+			[searchfield, "like", f"%{txt}%"],
+		],
+		fields=["name"],
+		order_by="name",
+		limit_start=start,
+		limit_page_length=page_len,
+		as_list=True,
 	)
 
 

erpnext/accounts/doctype/account/chart_of_accounts/chart_of_accounts.py

@@ -102,6 +102,8 @@ def identify_is_group(child):
 def get_chart(chart_template, existing_company=None):
 	chart = {}
 	if existing_company:
+		frappe.has_permission("Company", doc=existing_company, throw=True)
+
 		return get_account_tree_from_existing_company(existing_company)
 
 	elif chart_template == "Standard":

erpnext/accounts/doctype/accounting_dimension/accounting_dimension.js

@@ -16,6 +16,8 @@ frappe.ui.form.on("Accounting Dimension", {
 			return {
 				filters: {
 					name: ["not in", invalid_doctypes],
+					istable: 0,
+					issingle: 0,
 				},
 			};
 		});

erpnext/accounts/doctype/accounting_dimension/accounting_dimension.py

@@ -60,6 +60,14 @@ class AccountingDimension(Document):
 			msg = _("Not allowed to create accounting dimension for {0}").format(self.document_type)
 			frappe.throw(msg)
 
+		meta = frappe.get_meta(self.document_type)
+		if meta.istable or meta.issingle:
+			frappe.throw(
+				_(
+					"{0} cannot be used as an accounting dimension as it is not a standalone document type."
+				).format(frappe.bold(self.document_type))
+			)
+
 		exists = frappe.db.get_value("Accounting Dimension", {"document_type": self.document_type}, ["name"])
 
 		if exists and self.is_new():
@@ -227,8 +235,11 @@ def delete_accounting_dimension(doc):
 		frappe.clear_cache(doctype=doctype)
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def disable_dimension(doc):
+	# toggle_disabling rewrites a Custom Field site-wide, so demand the write that configures dimensions
+	frappe.has_permission("Accounting Dimension", "write", throw=True)
+
 	if frappe.in_test:
 		toggle_disabling(doc=doc)
 	else:

erpnext/accounts/doctype/accounting_dimension/test_accounting_dimension.py

@@ -52,6 +52,23 @@ class TestAccountingDimension(ERPNextTestSuite):
 		self.assertEqual(gle.get("department"), "_Test Department - _TC")
 		self.assertEqual(gle1.get("department"), "_Test Department - _TC")
 
+	def test_child_table_not_allowed_as_dimension(self):
+		dimension = frappe.get_doc({"doctype": "Accounting Dimension", "document_type": "Sales Team"})
+		self.assertRaises(frappe.ValidationError, dimension.insert)
+
+	def test_single_doctype_not_allowed_as_dimension(self):
+		dimension = frappe.get_doc({"doctype": "Accounting Dimension", "document_type": "Selling Settings"})
+		self.assertRaises(frappe.ValidationError, dimension.insert)
+
+	def test_non_scalar_dimension_value_skipped_in_gl_dict(self):
+		si = create_sales_invoice(do_not_save=1)
+
+		si.department = "_Test Department - _TC"
+		self.assertEqual(si.get_gl_dict({}).get("department"), "_Test Department - _TC")
+
+		si.department = ["_Test Department - _TC"]
+		self.assertNotIn("department", si.get_gl_dict({}))
+
 	def test_mandatory(self):
 		location = frappe.get_doc("Accounting Dimension", "Location")
 		location.dimension_defaults[0].mandatory_for_bs = True

erpnext/accounts/doctype/accounts_settings/accounts_settings.json

@@ -94,13 +94,14 @@
   "column_break_25",
   "reports_tab",
   "remarks_section",
-  "general_ledger_remarks_length",
-  "receivable_payable_remarks_length",
+  "disable_include_dimensions",
   "column_break_lvjk",
+  "general_ledger_remarks_length",
   "accounts_receivable_payable_tuning_section",
   "receivable_payable_fetch_method",
   "default_ageing_range",
   "column_break_ntmi",
+  "receivable_payable_remarks_length",
   "legacy_section",
   "ignore_is_opening_check_for_reporting",
   "tab_break_dpet",
@@ -198,10 +199,12 @@
   },
   {
    "default": "1",
+   "description": "System will use the latest saved Currency Exchange rate on or before the transaction date, however old it is. <br>\nUncheck to ignore rates older than Stale Days and fetch a fresh rate from the exchange rate provider instead.",
    "fieldname": "allow_stale",
    "fieldtype": "Check",
    "in_list_view": 1,
-   "label": "Allow Stale Exchange Rates"
+   "label": "Allow Stale Exchange Rates",
+   "show_description_on_click": 1
   },
   {
    "default": "1",
@@ -221,7 +224,8 @@
    "description": "The percentage you are allowed to bill more against the amount ordered. For example, if the order value is $100 for an item and tolerance is set as 10%, then you are allowed to bill up to $110 ",
    "fieldname": "over_billing_allowance",
    "fieldtype": "Currency",
-   "label": "Over Billing Allowance (%)"
+   "label": "Over Billing Allowance (%)",
+   "non_negative": 1
   },
   {
    "default": "1",
@@ -277,10 +281,10 @@
   },
   {
    "default": "0",
-   "description": "Block a new Sales Invoice when the customer's overdue amount exceeds the Overdue Limit set on the customer.",
+   "description": "Enabling this option prevents the creation of a new Sales Invoice when the customer has an overdue limit set and their outstanding overdue amount exceeds that limit.",
    "fieldname": "enable_overdue_billing_threshold",
    "fieldtype": "Check",
-   "label": "Restrict Customer Over Billing"
+   "label": "Prevent Sales Invoice when Customer is Overdue"
   },
   {
    "depends_on": "eval:doc.enable_overdue_billing_threshold",
@@ -474,7 +478,7 @@
   {
    "fieldname": "remarks_section",
    "fieldtype": "Section Break",
-   "label": "Remarks Column Length"
+   "label": "General Ledger Report"
   },
   {
    "default": "0",
@@ -548,7 +552,7 @@
   {
    "fieldname": "accounts_receivable_payable_tuning_section",
    "fieldtype": "Section Break",
-   "label": "Accounts Receivable / Payable Tuning"
+   "label": "Accounts Receivable / Payable Report"
   },
   {
    "fieldname": "legacy_section",
@@ -780,6 +784,12 @@
    "fieldname": "book_stock_expense_gl_entries",
    "fieldtype": "Check",
    "label": "Book Stock Expense GL Entries"
+  },
+  {
+   "default": "0",
+   "fieldname": "disable_include_dimensions",
+   "fieldtype": "Check",
+   "label": "Disable \"Consider Accounting Dimension\" Filter"
   }
  ],
  "grid_page_length": 50,
@@ -788,7 +798,7 @@
  "index_web_pages_for_search": 1,
  "issingle": 1,
  "links": [],
- "modified": "2026-07-27 12:00:00.000000",
+ "modified": "2026-09-04 10:08:30.115003",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Accounts Settings",

erpnext/accounts/doctype/accounts_settings/accounts_settings.py

@@ -72,6 +72,7 @@ class AccountsSettings(Document):
 		default_ageing_range: DF.Data | None
 		delete_linked_ledger_entries: DF.Check
 		determine_address_tax_category_from: DF.Literal["Billing Address", "Shipping Address"]
+		disable_include_dimensions: DF.Check
 		enable_accounting_dimensions: DF.Check
 		enable_common_party_accounting: DF.Check
 		enable_discounts_and_margin: DF.Check
@@ -220,6 +221,13 @@ class AccountsSettings(Document):
 		set_allow_on_submit_for_dimension_fields(doctypes)
 
 
+@frappe.whitelist(methods=["POST"])
+def get_posting_date_confirmation() -> int:
+	return cint(
+		frappe.db.get_single_value("Accounts Settings", "confirm_before_resetting_posting_date", cache=False)
+	)
+
+
 def toggle_accounting_dimension_sections(hide):
 	accounting_dimension_doctypes = frappe.get_hooks("accounting_dimension_doctypes")
 	for doctype in accounting_dimension_doctypes:

erpnext/accounts/doctype/accounts_settings/test_accounts_settings.py

@@ -2,10 +2,16 @@ import unittest
 
 import frappe
 
+from erpnext.accounts.doctype.accounts_settings.accounts_settings import get_posting_date_confirmation
 from erpnext.tests.utils import ERPNextTestSuite
 
 
 class TestAccountsSettings(ERPNextTestSuite):
+	def test_posting_date_confirmation_uses_current_setting(self):
+		for enabled in (0, 1, 0):
+			frappe.db.set_single_value("Accounts Settings", "confirm_before_resetting_posting_date", enabled)
+			self.assertEqual(get_posting_date_confirmation(), enabled)
+
 	def test_stale_days(self):
 		cur_settings = frappe.get_doc("Accounts Settings", "Accounts Settings")
 		cur_settings.allow_stale = 0

erpnext/accounts/doctype/bank/bank.json

@@ -101,7 +101,7 @@
   }
  ],
  "links": [],
- "modified": "2024-03-27 13:06:36.896195",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Bank",
@@ -118,6 +118,14 @@
    "role": "System Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Accounts Manager",
+   "select": 1
+  },
+  {
+   "role": "Accounts User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/bank_account/bank_account.json

@@ -269,7 +269,7 @@
    "link_fieldname": "default_bank_account"
   }
  ],
- "modified": "2026-04-11 19:46:27.609994",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Bank Account",
@@ -299,6 +299,22 @@
    "role": "Accounts User",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/bank_guarantee/bank_guarantee.py

@@ -60,6 +60,9 @@ def get_voucher_details(bank_guarantee_type: str, reference_name: str):
 	if not isinstance(reference_name, str):
 		raise TypeError("reference_name must be a string")
 
+	# the form is the boundary, not the referenced order: an order guard would break one of the two roles
+	frappe.has_permission("Bank Guarantee", throw=True)
+
 	fields_to_fetch = ["grand_total"]
 
 	if bank_guarantee_type == "Receiving":

erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.js

@@ -68,6 +68,7 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 				frappe.msgprint(__("Please select Bank Account"));
 				return;
 			}
+			frm.events.validate_dates(frm);
 			frappe.call({
 				method: "erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool.auto_reconcile_vouchers",
 				args: {
@@ -82,7 +83,7 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 		});
 
 		frm.add_custom_button(__("Get Unreconciled Entries"), function () {
-			frm.trigger("make_reconciliation_tool");
+			return frm.trigger("make_reconciliation_tool");
 		});
 		frm.change_custom_button_type(__("Get Unreconciled Entries"), null, "primary");
 
@@ -106,7 +107,24 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 		frm.trigger("get_account_opening_balance");
 	},
 
+	validate_dates(frm) {
+		const from_date = frm.doc.filter_by_reference_date
+			? frm.doc.from_reference_date
+			: frm.doc.bank_statement_from_date;
+		const to_date = frm.doc.filter_by_reference_date
+			? frm.doc.to_reference_date
+			: frm.doc.bank_statement_to_date;
+		if (from_date && to_date && from_date > to_date) {
+			frappe.throw(
+				frm.doc.filter_by_reference_date
+					? __("From Reference Date cannot be greater than To Reference Date")
+					: __("From Date cannot be greater than To Date")
+			);
+		}
+	},
+
 	make_reconciliation_tool(frm) {
+		frm.events.validate_dates(frm);
 		frm.get_field("reconciliation_tool_cards").$wrapper.empty();
 		if (frm.doc.company && frm.doc.bank_account && frm.doc.bank_statement_to_date) {
 			frm.trigger("get_cleared_balance").then(() => {

erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.py

@@ -10,7 +10,7 @@ from frappe import _
 from frappe.model.document import Document
 from frappe.query_builder.custom import ConstantColumn
 from frappe.query_builder.functions import Sum
-from frappe.utils import cint, create_batch, flt
+from frappe.utils import cint, create_batch, flt, getdate
 
 from erpnext import get_default_cost_center
 from erpnext.accounts.doctype.bank_transaction.bank_transaction import get_total_allocated_amount
@@ -55,6 +55,8 @@ def get_bank_transactions(
 	all_transactions: bool = False,
 ):
 	# returns bank transactions for a bank account
+	validate_date_range(from_date, to_date)
+
 	filters = []
 	filters.append(["bank_account", "=", bank_account])
 	filters.append(["docstatus", "=", 1])
@@ -794,6 +796,7 @@ def create_bulk_payment_entry_and_reconcile(
 				"deposit",
 				"withdrawal",
 				"bank_account",
+				"company",
 				"currency",
 				"unallocated_amount",
 				"date",
@@ -828,11 +831,7 @@ def create_bulk_payment_entry_and_reconcile(
 				"paid_from": paid_from,
 				"paid_to": paid_to,
 				"paid_amount": bank_transaction.unallocated_amount,
-				"base_paid_amount": bank_transaction.unallocated_amount,
 				"received_amount": bank_transaction.unallocated_amount,
-				"base_received_amount": bank_transaction.unallocated_amount,
-				"target_exchange_rate": 1,
-				"source_exchange_rate": 1,
 				"reference_date": bank_transaction.date,
 				"posting_date": bank_transaction.date,
 				"reference_no": (bank_transaction.reference_number or bank_transaction.description or "")[
@@ -841,6 +840,8 @@ def create_bulk_payment_entry_and_reconcile(
 			}
 		)
 
+		set_multi_currency_amounts(payment_entry_doc)
+
 		payment_entry_doc.insert()
 		payment_entry_doc.submit()
 
@@ -879,6 +880,7 @@ def create_payment_entry_and_reconcile(bank_transaction_name: str | int, payment
 			"doctype": "Payment Entry",
 		}
 	)
+	set_multi_currency_amounts(payment_entry)
 	payment_entry.insert()
 	payment_entry.submit()
 	transaction = reconcile_vouchers(
@@ -901,6 +903,33 @@ def create_payment_entry_and_reconcile(bank_transaction_name: str | int, payment
 	}
 
 
+def set_multi_currency_amounts(pe):
+	"""Set real exchange rates when the bank and party accounts differ in currency."""
+	company_currency = frappe.get_cached_value("Company", pe.company, "default_currency")
+	pe.paid_from_account_currency = frappe.get_cached_value("Account", pe.paid_from, "account_currency")
+	pe.paid_to_account_currency = frappe.get_cached_value("Account", pe.paid_to, "account_currency")
+
+	pe.source_exchange_rate = (
+		1.0
+		if pe.paid_from_account_currency == company_currency
+		else get_exchange_rate(pe.paid_from_account_currency, company_currency, pe.posting_date)
+	)
+	pe.target_exchange_rate = (
+		1.0
+		if pe.paid_to_account_currency == company_currency
+		else get_exchange_rate(pe.paid_to_account_currency, company_currency, pe.posting_date)
+	)
+
+	# derive the party-side amount from the authoritative bank-side amount; Payment Entry books any
+	# rounding residual to Exchange Gain/Loss during validation (set_exchange_gain_loss)
+	if pe.payment_type == "Receive" and pe.source_exchange_rate:
+		base_amount = flt(pe.received_amount) * pe.target_exchange_rate
+		pe.paid_amount = flt(base_amount / pe.source_exchange_rate, pe.precision("paid_amount"))
+	elif pe.payment_type == "Pay" and pe.target_exchange_rate:
+		base_amount = flt(pe.paid_amount) * pe.source_exchange_rate
+		pe.received_amount = flt(base_amount / pe.target_exchange_rate, pe.precision("received_amount"))
+
+
 @frappe.whitelist(methods=["GET"])
 def search_for_transfer_transaction(transaction_id: str | int):
 	"""
@@ -916,7 +945,7 @@ def search_for_transfer_transaction(transaction_id: str | int):
 
 	days = frappe.db.get_single_value("Accounts Settings", "transfer_match_days")
 
-	if not days:
+	if days is None:
 		days = 3
 
 	min_date = frappe.utils.add_days(date, -days)
@@ -969,6 +998,7 @@ def auto_reconcile_vouchers(
 	from_reference_date: str | date | None = None,
 	to_reference_date: str | date | None = None,
 ):
+	validate_date_range(from_date, to_date, filter_by_reference_date, from_reference_date, to_reference_date)
 	bank_transactions = get_bank_transactions(bank_account)
 
 	if len(bank_transactions) > 10:
@@ -1087,6 +1117,7 @@ def get_linked_payments(
 	to_reference_date: str | date | None = None,
 ):
 	# get all matching payments for a bank transaction
+	validate_date_range(from_date, to_date, filter_by_reference_date, from_reference_date, to_reference_date)
 	transaction = frappe.get_doc("Bank Transaction", bank_transaction_name)
 	bank_account = frappe.db.get_values(
 		"Bank Account", transaction.bank_account, ["account", "company"], as_dict=True
@@ -1106,6 +1137,23 @@ def get_linked_payments(
 	return subtract_allocations(gl_account, matching)
 
 
+def validate_date_range(
+	from_date,
+	to_date,
+	filter_by_reference_date=False,
+	from_reference_date=None,
+	to_reference_date=None,
+):
+	if cint(filter_by_reference_date):
+		from_date, to_date = from_reference_date, to_reference_date
+		message = _("From Reference Date cannot be greater than To Reference Date")
+	else:
+		message = _("From Date cannot be greater than To Date")
+
+	if from_date and to_date and getdate(from_date) > getdate(to_date):
+		frappe.throw(message)
+
+
 def subtract_allocations(gl_account, vouchers):
 	"Look up & subtract any existing Bank Transaction allocations"
 	copied = []
@@ -1340,9 +1388,11 @@ def get_pe_matching_query(
 	ref_condition = pe.reference_no == transaction.reference_number
 	ref_rank = frappe.qb.terms.Case().when(ref_condition, 1).else_(0)
 
-	amount_equality = pe.paid_amount == transaction.unallocated_amount
+	amount_field = pe.received_amount_after_tax if account_from_to == "paid_to" else pe.paid_amount_after_tax
+
+	amount_equality = amount_field == transaction.unallocated_amount
 	amount_rank = frappe.qb.terms.Case().when(amount_equality, 1).else_(0)
-	amount_condition = amount_equality if exact_match else pe.paid_amount > 0.0
+	amount_condition = amount_equality if exact_match else amount_field > 0.0
 
 	party_condition = (
 		(pe.party_type == transaction.party_type) & (pe.party == transaction.party) & pe.party.isnotnull()
@@ -1359,7 +1409,7 @@ def get_pe_matching_query(
 			(ref_rank + amount_rank + party_rank + 1).as_("rank"),
 			ConstantColumn("Payment Entry").as_("doctype"),
 			pe.name,
-			pe.base_paid_amount_after_tax.as_("paid_amount"),
+			amount_field.as_("paid_amount"),
 			pe.reference_no,
 			pe.reference_date,
 			pe.party,

erpnext/accounts/doctype/bank_reconciliation_tool/test_bank_reconciliation_tool.py

@@ -2,18 +2,26 @@
 # See license.txt
 
 
+from unittest.mock import patch
+
 import frappe
 from frappe import qb
 from frappe.utils import add_days, today
 
 from erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool import (
 	auto_reconcile_vouchers,
+	create_bulk_payment_entry_and_reconcile,
+	create_payment_entry_and_reconcile,
+	get_auto_reconcile_message,
 	get_bank_transactions,
+	get_linked_payments,
 )
 from erpnext.accounts.doctype.payment_entry.test_payment_entry import create_payment_entry
 from erpnext.accounts.test.accounts_mixin import AccountsTestMixin
 from erpnext.tests.utils import ERPNextTestSuite
 
+RATE_METHOD = "erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool.get_exchange_rate"
+
 
 class TestBankReconciliationTool(ERPNextTestSuite, AccountsTestMixin):
 	def setUp(self):
@@ -97,3 +105,244 @@ class TestBankReconciliationTool(ERPNextTestSuite, AccountsTestMixin):
 		# assert API output post reconciliation
 		transactions = get_bank_transactions(self.bank_account, from_date, to_date)
 		self.assertEqual(len(transactions), 0)
+
+	def make_bank_transaction(self, date, deposit=100, withdrawal=0):
+		return (
+			frappe.get_doc(
+				{
+					"doctype": "Bank Transaction",
+					"date": date,
+					"deposit": deposit,
+					"withdrawal": withdrawal,
+					"bank_account": self.bank_account,
+					"currency": "INR",
+				}
+			)
+			.save()
+			.submit()
+		)
+
+	def get_matching_payment_entries(self, bank_transaction, exact_match=False):
+		document_types = ["payment_entry", "exact_match"] if exact_match else ["payment_entry"]
+		vouchers = get_linked_payments(
+			bank_transaction,
+			document_types,
+			from_date=add_days(today(), -1),
+			to_date=today(),
+		)
+		return [v for v in vouchers if v.get("doctype") == "Payment Entry"]
+
+	def test_get_bank_transactions_excludes_dates_after_to_date(self):
+		self.make_bank_transaction(date=today())
+		names = [t.name for t in get_bank_transactions(self.bank_account, to_date=add_days(today(), -1))]
+		self.assertEqual(names, [])
+
+	def test_rejects_reversed_date_ranges(self):
+		from_date, to_date = today(), add_days(today(), -1)
+		with self.assertRaisesRegex(frappe.ValidationError, "From Date cannot be greater than To Date"):
+			get_bank_transactions(self.bank_account, from_date, to_date)
+
+		with self.assertRaisesRegex(
+			frappe.ValidationError, "From Reference Date cannot be greater than To Reference Date"
+		):
+			auto_reconcile_vouchers(
+				self.bank_account,
+				filter_by_reference_date=True,
+				from_reference_date=from_date,
+				to_reference_date=to_date,
+			)
+
+		transaction = self.make_bank_transaction(date=today())
+		with self.assertRaisesRegex(
+			frappe.ValidationError, "From Reference Date cannot be greater than To Reference Date"
+		):
+			get_linked_payments(
+				transaction.name,
+				["payment_entry"],
+				filter_by_reference_date=True,
+				from_reference_date=from_date,
+				to_reference_date=to_date,
+			)
+
+	def test_deposit_matches_amount_received_in_bank_account(self):
+		# money leaves another bank account and lands here minus a charge, so the two sides differ
+		payment = frappe.get_doc(
+			{
+				"doctype": "Payment Entry",
+				"payment_type": "Internal Transfer",
+				"company": self.company,
+				"posting_date": today(),
+				"paid_from": "_Test Bank - _TC",
+				"paid_to": self.bank,
+				"paid_amount": 3537.64,
+				"received_amount": 3460.52,
+				"reference_no": "TRF-001",
+				"reference_date": today(),
+			}
+		)
+		payment.set_missing_values()
+		payment.set_exchange_rate()
+		payment.set_amounts()
+		payment.deductions[-1].account = "_Test Exchange Gain/Loss - _TC"
+		payment.deductions[-1].cost_center = "_Test Cost Center - _TC"
+		payment = payment.save().submit()
+
+		transaction = self.make_bank_transaction(date=today(), deposit=3460.52)
+
+		# the received side is what reached this bank account, so that is what is shown
+		matches = self.get_matching_payment_entries(transaction.name)
+		self.assertEqual([m["name"] for m in matches], [payment.name])
+		self.assertEqual(matches[0]["paid_amount"], 3460.52)
+
+		# and what the exact match compares against
+		exact_matches = self.get_matching_payment_entries(transaction.name, exact_match=True)
+		self.assertEqual([m["name"] for m in exact_matches], [payment.name])
+
+	def test_withdrawal_matches_amount_paid_from_bank_account(self):
+		payment = create_payment_entry(
+			company=self.company,
+			payment_type="Pay",
+			party_type="Supplier",
+			party="_Test Supplier",
+			paid_from=self.bank,
+			paid_to="Creditors - _TC",
+			paid_amount=1250,
+		)
+		payment = payment.save().submit()
+
+		transaction = self.make_bank_transaction(date=today(), deposit=0, withdrawal=1250)
+
+		exact_matches = self.get_matching_payment_entries(transaction.name, exact_match=True)
+		self.assertEqual([m["name"] for m in exact_matches], [payment.name])
+		self.assertEqual(exact_matches[0]["paid_amount"], 1250)
+
+	def test_auto_reconcile_message_for_no_matches(self):
+		message, indicator = get_auto_reconcile_message([], [])
+		self.assertEqual(indicator, "blue")
+		self.assertIn("No matches", message)
+
+	def test_auto_reconcile_message_counts_and_pluralizes(self):
+		# reconciled count is reported and the indicator turns green
+		message, indicator = get_auto_reconcile_message([], ["t1", "t2"])
+		self.assertEqual(indicator, "green")
+		self.assertIn("2 Transaction(s) Reconciled", message)
+
+		# partially-reconciled label is singular for one, plural for many
+		singular, _ = get_auto_reconcile_message(["p1"], [])
+		self.assertIn("1 Transaction Partially Reconciled", singular)
+		plural, _ = get_auto_reconcile_message(["p1", "p2"], [])
+		self.assertIn("2 Transactions Partially Reconciled", plural)
+
+	def test_multi_currency_pay_converts_and_balances(self):
+		# withdrawal from an INR bank paying a USD supplier; rate 3.0 makes 100/3 non-exact
+		self.enable_multi_currency_setup()
+		pe = self.reconcile_new_payment(
+			self.make_multi_currency_txn(withdrawal=100),
+			payment_type="Pay",
+			party_type="Supplier",
+			party=self.supplier,
+			party_account=self.creditors_usd,
+			paid_from=self.bank,
+			paid_to=self.creditors_usd,
+			rate=3.0,
+		)
+		self.assertEqual(pe.docstatus, 1)  # submits despite the rounding residual
+		self.assertEqual((pe.source_exchange_rate, pe.target_exchange_rate), (1.0, 3.0))
+		self.assertEqual((pe.paid_amount, pe.received_amount), (100, 33.33))  # bank side kept, 100/3
+		self.assertEqual(pe.difference_amount, 0)
+		# Payment Entry auto-books the rounding residual to Exchange Gain/Loss
+		self.assertTrue(pe.deductions[0].is_exchange_gain_loss)
+		self.assertEqual(pe.deductions[0].amount, 0.01)  # 100 - 33.33 * 3
+
+	def test_multi_currency_receive_converts_and_balances(self):
+		# deposit into an INR bank from a USD customer; the party side must convert
+		self.enable_multi_currency_setup()
+		pe = self.reconcile_new_payment(
+			self.make_multi_currency_txn(deposit=100),
+			payment_type="Receive",
+			party_type="Customer",
+			party=self.customer,
+			party_account=self.debtors_usd,
+			paid_from=self.debtors_usd,
+			paid_to=self.bank,
+			rate=3.0,
+		)
+		self.assertEqual(pe.docstatus, 1)
+		self.assertEqual((pe.source_exchange_rate, pe.target_exchange_rate), (3.0, 1.0))
+		self.assertEqual((pe.received_amount, pe.paid_amount), (100, 33.33))  # bank side kept, 100/3
+		self.assertEqual(pe.difference_amount, 0)
+
+	def test_multi_currency_bulk_pay_converts_and_balances(self):
+		# the bulk path builds the Payment Entry itself, so it must convert too
+		self.enable_multi_currency_setup()
+		txn = self.make_multi_currency_txn(withdrawal=100)
+		with patch(RATE_METHOD, return_value=3.0):
+			result = create_bulk_payment_entry_and_reconcile(
+				[txn.name], "Supplier", self.supplier, self.creditors_usd
+			)
+
+		pe = frappe.get_doc("Payment Entry", result[0]["payment_entry"].name)
+		self.assertEqual(pe.docstatus, 1)
+		self.assertEqual(pe.target_exchange_rate, 3.0)
+		self.assertEqual((pe.paid_amount, pe.received_amount), (100, 33.33))
+		self.assertEqual(pe.difference_amount, 0)
+
+	def enable_multi_currency_setup(self):
+		# USD party/accounts + a company gain/loss account to absorb rounding residuals
+		self.company_abbr = "_TC"
+		self.create_supplier(supplier_name="_Test Supplier USD", currency="USD")
+		self.create_customer(customer_name="_Test Customer USD", currency="USD")
+		self.create_usd_payable_account()
+		self.create_usd_receivable_account()
+		self.set_party_account("Supplier", self.supplier, self.creditors_usd)
+		if not frappe.db.get_value("Company", self.company, "exchange_gain_loss_account"):
+			frappe.db.set_value(
+				"Company", self.company, "exchange_gain_loss_account", "Exchange Gain/Loss - _TC"
+			)
+
+	def set_party_account(self, party_type, party, account):
+		doc = frappe.get_doc(party_type, party)
+		if not any(row.company == self.company for row in doc.accounts):
+			doc.append("accounts", {"company": self.company, "account": account})
+			doc.save()
+
+	def make_multi_currency_txn(self, withdrawal=0, deposit=0):
+		return (
+			frappe.get_doc(
+				{
+					"doctype": "Bank Transaction",
+					"date": today(),
+					"withdrawal": withdrawal,
+					"deposit": deposit,
+					"bank_account": self.bank_account,
+					"currency": "INR",
+					"reference_number": "TEST-FX-REF",
+				}
+			)
+			.save()
+			.submit()
+		)
+
+	def reconcile_new_payment(
+		self, txn, *, payment_type, party_type, party, party_account, paid_from, paid_to, rate
+	):
+		# mimics the /banking frontend, which sends a hardcoded 1:1 rate
+		payment_entry_doc = {
+			"payment_type": payment_type,
+			"company": self.company,
+			"party_type": party_type,
+			"party": party,
+			"party_account": party_account,
+			"paid_from": paid_from,
+			"paid_to": paid_to,
+			"paid_amount": txn.unallocated_amount,
+			"received_amount": txn.unallocated_amount,
+			"source_exchange_rate": 1,
+			"target_exchange_rate": 1,
+			"posting_date": today(),
+			"reference_no": f"TEST-FX-{payment_type}",
+			"reference_date": today(),
+		}
+		with patch(RATE_METHOD, return_value=rate):
+			result = create_payment_entry_and_reconcile(txn.name, payment_entry_doc)
+		return frappe.get_doc("Payment Entry", result["payment_entry"].name)

erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py

@@ -167,9 +167,10 @@ def get_transaction_reference(txn_data: dict) -> str:
 	).strip()
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def convert_mt940_to_csv(data_import, mt940_file_path):
 	doc = frappe.get_doc("Bank Statement Import", data_import)
+	doc.check_permission("write")
 
 	_file_doc, content = get_file(mt940_file_path)
 
@@ -234,26 +235,30 @@ def convert_mt940_to_csv(data_import, mt940_file_path):
 
 @frappe.whitelist()
 def get_preview_from_template(data_import, import_file=None, google_sheets_url=None):
-	return frappe.get_doc("Bank Statement Import", data_import).get_preview_from_template(
-		import_file, google_sheets_url
-	)
+	bsi = frappe.get_doc("Bank Statement Import", data_import)
+	bsi.check_permission()
+	return bsi.get_preview_from_template(import_file, google_sheets_url)
 
 
 @frappe.whitelist()
 def form_start_import(data_import):
-	job_id = frappe.get_doc("Bank Statement Import", data_import).start_import()
-	return job_id is not None
+	bsi = frappe.get_doc("Bank Statement Import", data_import)
+	bsi.check_permission("write")
+	return bsi.start_import()
 
 
 @frappe.whitelist()
 def download_errored_template(data_import_name):
 	data_import = frappe.get_doc("Bank Statement Import", data_import_name)
+	data_import.check_permission()
 	data_import.export_errored_rows()
 
 
 @frappe.whitelist()
 def download_import_log(data_import_name):
-	return frappe.get_doc("Bank Statement Import", data_import_name).download_import_log()
+	bsi = frappe.get_doc("Bank Statement Import", data_import_name)
+	bsi.check_permission()
+	return bsi.download_import_log()
 
 
 def is_mt940_format(content: str) -> bool:
@@ -392,6 +397,7 @@ def get_import_status(docname):
 	import_status = {}
 
 	data_import = frappe.get_doc("Bank Statement Import", docname)
+	data_import.check_permission()
 	import_status["status"] = data_import.status
 
 	logs = frappe.get_all(
@@ -430,6 +436,9 @@ def get_import_logs(docname: str):
 
 @frappe.whitelist()
 def upload_bank_statement(**args):
+	# The only caller routes into a new Bank Statement Import form, so `create` is the right to require.
+	frappe.has_permission("Bank Statement Import", "create", throw=True)
+
 	args = frappe._dict(args)
 	bsi = frappe.new_doc("Bank Statement Import")
 

erpnext/accounts/doctype/bank_statement_import_log/bank_statement_import_log.py

@@ -375,8 +375,7 @@ class BankStatementImportLog(Document):
 				table["column_mapping"] = guess_column_mapping_by_content(table["rows"])
 
 			final_transactions, table["date_format"], table["amount_format"] = build_table_transactions(table)
-			# Tables with no detectable transactions (ads, summaries, headers) start excluded.
-			table["included"] = bool(final_transactions)
+			table["included"] = should_include_table(table, final_transactions)
 
 		self.pdf_tables = json.dumps(tables)
 		return tables
@@ -542,6 +541,8 @@ class BankStatementImportLog(Document):
 				"bank-rec-statement-import-progress",
 				{
 					"progress": round(progress / total_transactions * 100),
+					"current": progress,
+					"total": total_transactions,
 				},
 				doctype="Bank Statement Import Log",
 				docname=self.name,
@@ -551,6 +552,7 @@ class BankStatementImportLog(Document):
 			"bank-rec-statement-import-progress",
 			{
 				"progress": 100,
+				"current": total_transactions,
 				"total": total_transactions,
 			},
 			doctype="Bank Statement Import Log",
@@ -821,6 +823,15 @@ def compute_final_transactions(transaction_rows: list, date_format: str, amount_
 	"""Pure version of the final-transaction builder (date normalized, amount split)."""
 	final_transactions = []
 
+	# Which marker does this statement actually write? A statement that only ever says "Cr"
+	# is marking the credits as its exceptions, so an unmarked row is a withdrawal; one that
+	# only ever says "Dr" means the opposite. With both markers present an unmarked row is
+	# genuinely undetermined, so it stays a withdrawal.
+	unmarked_is_deposit = False
+	if amount_format == 'Amount column has "CR"/"DR" values':
+		markers = {get_amount_cr_dr_marker(row.get("amount")) for row in transaction_rows}
+		unmarked_is_deposit = markers - {None} == {"dr"}
+
 	def parse_amount(transaction_row: dict):
 		if amount_format == "Separate columns for withdrawal and deposit":
 			return get_float_amount(transaction_row.get("withdrawal")), get_float_amount(
@@ -829,44 +840,43 @@ def compute_final_transactions(transaction_rows: list, date_format: str, amount_
 
 		if amount_format == 'Amount column has "CR"/"DR" values':
 			amount = transaction_row.get("amount")
+			marker = get_amount_cr_dr_marker(amount)
+			# The marker carries the direction, so the amount's own sign is ignored.
+			signed_amount = get_float_amount(amount) or 0
 
-			# If the amount column has CR/DR in it - we should remove any signs (negative or positive) from the amount
-			float_amount = abs(get_float_amount(amount) or 0)
-			if "cr" in amount.lower():
-				return 0, float_amount
-			else:
-				return float_amount, 0
+			if marker:
+				return (0, abs(signed_amount)) if marker == "cr" else (abs(signed_amount), 0)
 
+			# An unmarked row takes the opposite direction to the marker this statement
+			# uses. A negative amount reverses that again (a refund).
+			is_deposit = unmarked_is_deposit
+			if signed_amount < 0:
+				is_deposit = not is_deposit
+
+			return (0, abs(signed_amount)) if is_deposit else (abs(signed_amount), 0)
+
+		# `or 0` below: get_float_amount returns None for an unparseable cell, and a blank
+		# transaction-type cell comes through as None. Both used to raise.
 		if amount_format == "Amount column has positive/negative values":
-			amount = get_float_amount(transaction_row.get("amount", "0"))
+			amount = get_float_amount(transaction_row.get("amount", "0")) or 0
 			if amount > 0:
 				return 0, abs(amount)
 			else:
 				return abs(amount), 0
 
+		transaction_type = str(transaction_row.get("debit_credit") or "").strip().lower()
+		amount = abs(get_float_amount(transaction_row.get("amount", "0")) or 0)
+
 		if amount_format == 'Transaction type column has "CR"/"DR" values':
-			transaction_type = transaction_row.get("debit_credit")
-			amount = get_float_amount(transaction_row.get("amount", "0"))
-			if "cr" in transaction_type.lower():
-				return 0, abs(amount)
-			else:
-				return abs(amount), 0
+			# "credit" contains "cr". "debit" does not contain "dr", so it correctly falls
+			# through to the withdrawal side.
+			return (0, amount) if "cr" in transaction_type else (amount, 0)
 
 		if amount_format == 'Transaction type column has "C"/"D" values':
-			transaction_type = transaction_row.get("debit_credit")
-			amount = get_float_amount(transaction_row.get("amount", "0"))
-			if transaction_type.lower().strip() == "c":
-				return 0, abs(amount)
-			else:
-				return abs(amount), 0
+			return (0, amount) if transaction_type == "c" else (amount, 0)
 
 		if amount_format == 'Transaction type column has "Deposit"/"Withdrawal" values':
-			transaction_type = transaction_row.get("debit_credit")
-			amount = get_float_amount(transaction_row.get("amount", "0"))
-			if "deposit" in transaction_type.lower():
-				return 0, abs(amount)
-			else:
-				return abs(amount), 0
+			return (0, amount) if "deposit" in transaction_type else (amount, 0)
 
 		return 0, 0
 
@@ -910,6 +920,26 @@ def build_table_transactions(table: dict):
 	return final_transactions, date_format, amount_format
 
 
+def should_include_table(table: dict, final_transactions: list) -> bool:
+	"""
+	Whether a freshly extracted PDF table should START as included - only the default state
+	of the checkbox, which the user can change afterwards.
+
+	It must have yielded transactions, and it must have a Description column mapped. A
+	transaction table always carries a narration; the summary boxes printed around it -
+	payment due, credit limit, reward points - are dates and figures only. Otherwise the
+	HDFC credit-card "Payment Due Date / Total Dues / Minimum Amount Due" box parses as one
+	transaction and imports a phantom row.
+
+	A description is NOT needed to import (it is not mandatory on Bank Transaction), so a
+	bank that omits narration still works - its table just starts unticked.
+	"""
+	if not final_transactions:
+		return False
+
+	return any(column.get("maps_to") == "Description" for column in table.get("column_mapping", []))
+
+
 def _clean_cell(cell) -> str:
 	"""Normalize a pdfplumber cell: None -> '', collapse wrapped newlines, strip."""
 	if cell is None:
@@ -1055,6 +1085,43 @@ def get_float_amount(amount):
 	return amount
 
 
+# A "CR"/"DR" marker on the amount itself, at either end: "2,378.00Cr", "Cr 100",
+# "INR 50.90 Cr.", "DR 1,234.50".
+# `(?![a-zA-Z])` rather than `\b` on the leading form: there is no word boundary between
+# the "r" of "Cr100" and the digit, but there IS one inside "CREDIT" and "DRAFT".
+AMOUNT_CR_DR_PATTERN = re.compile(r"^\s*(cr|dr)(?![a-zA-Z])\.?|(?:^|[\s\d.)])(cr|dr)\b\.?\s*$", re.IGNORECASE)
+
+
+def get_amount_cr_dr_marker(amount) -> str | None:
+	"""
+	Return "cr" or "dr" if the amount cell carries a direction marker of its own, else None.
+
+	What is left after removing the marker has to look like an amount - it must hold a digit
+	and at most a short currency token - so that text which merely starts or ends with the
+	letters is not read as a marker. That guard is what separates "Cr 100" from a
+	description that bled into the amount column, like "Dr Smith Clinic 500".
+	"""
+	if not isinstance(amount, str):
+		return None
+
+	match = AMOUNT_CR_DR_PATTERN.search(amount)
+	if not match:
+		return None
+
+	# Only the marker itself is removed - the surrounding character the pattern needed to
+	# anchor on (a digit, say) stays part of the remainder.
+	group = 1 if match.group(1) else 2
+	start, end = match.span(group)
+	remainder = amount[:start] + amount[end:]
+
+	if not any(char.isdigit() for char in remainder):
+		return None
+	if sum(char.isalpha() for char in remainder) > 3:
+		return None
+
+	return match.group(group).lower()
+
+
 def get_file_properties(transactions: list):
 	"""
 	From the transaction rows, try to figure out the following:
@@ -1075,6 +1142,8 @@ def get_file_properties(transactions: list):
 		'Transaction type column has "C"/"D" values': 0,
 	}
 
+	amount_column_has_cr_dr = False
+
 	for transaction in transactions:
 		date_format = transaction.get("date_format")
 
@@ -1092,33 +1161,40 @@ def get_file_properties(transactions: list):
 		if not amount:
 			continue
 
-		if isinstance(amount, str) and ("cr" in amount.lower() or "dr" in amount.lower()):
+		debit_credit = str(transaction.get("debit_credit") or "").strip().lower()
+
+		# One vote per row, most specific signal first. Order matters: "withdrawal" contains
+		# "dr", so it must be matched before the loose cr/dr check or a Deposit/Withdrawal
+		# column reads as CR/DR. "debit" needs listing because, unlike "credit", it does not
+		# contain "dr". The final else means every row votes, even an unrecognised type.
+		if get_amount_cr_dr_marker(amount):
+			amount_column_has_cr_dr = True
 			amount_format_frequency['Amount column has "CR"/"DR" values'] += 1
-
-		# Check if there's a debit_credit column containing "cr"/"dr"
-		if transaction.get("debit_credit", None):
-			if (
-				"cr" in transaction.get("debit_credit", "").lower()
-				or "dr" in transaction.get("debit_credit", "").lower()
-			):
-				amount_format_frequency['Transaction type column has "CR"/"DR" values'] += 1
-			elif (
-				"deposit" in transaction.get("debit_credit", "").lower()
-				or "withdrawal" in transaction.get("debit_credit", "").lower()
-			):
-				amount_format_frequency['Transaction type column has "Deposit"/"Withdrawal" values'] += 1
-			elif (transaction.get("debit_credit", "").lower().strip() == "c") or (
-				transaction.get("debit_credit", "").lower().strip() == "d"
-			):
-				amount_format_frequency['Transaction type column has "C"/"D" values'] += 1
-
-		# Else assume that the amount is expressed as positive/negative value
+		elif "deposit" in debit_credit or "withdrawal" in debit_credit:
+			amount_format_frequency['Transaction type column has "Deposit"/"Withdrawal" values'] += 1
+		elif debit_credit in ("c", "d"):
+			amount_format_frequency['Transaction type column has "C"/"D" values'] += 1
+		elif any(token in debit_credit for token in ("cr", "dr", "debit")):
+			amount_format_frequency['Transaction type column has "CR"/"DR" values'] += 1
 		else:
+			# Nothing said which direction this is, so assume the amount carries the sign.
 			amount_format_frequency["Amount column has positive/negative values"] += 1
 
 	most_common_date_format = max(date_format_frequency, key=date_format_frequency.get)
 	most_common_amount_format = max(amount_format_frequency, key=amount_format_frequency.get)
 
+	# With no votes at all (no rows, or every amount blank) max() would return whichever key
+	# happens to be first in the dict. Say what we mean instead.
+	if not amount_format_frequency[most_common_amount_format]:
+		most_common_amount_format = "Amount column has positive/negative values"
+
+	# A CR/DR amount column is proved by a single marker, not by a majority: both formats
+	# describe the same column, and an unmarked row is only the default direction, not
+	# evidence against the notation. Statements mark just the exceptions - one HDFC
+	# credit-card page has 18 rows and a single "50.90Cr".
+	if amount_column_has_cr_dr and most_common_amount_format == "Amount column has positive/negative values":
+		most_common_amount_format = 'Amount column has "CR"/"DR" values'
+
 	return most_common_date_format, most_common_amount_format
 
 

erpnext/accounts/doctype/bank_statement_import_log/test_bank_statement_import_log.py

@@ -11,12 +11,14 @@ from erpnext.accounts.doctype.bank_statement_import_log.bank_statement_import_lo
 	detect_column_mapping,
 	detect_header_row,
 	extract_pdf_tables,
+	get_amount_cr_dr_marker,
 	get_float_amount,
 	get_statement_details,
 	guess_column_mapping_by_content,
 	reextract_pdf_table,
 	set_header_index,
 	set_pdf_table_header,
+	should_include_table,
 	update_column_mapping,
 	update_pdf_tables,
 )
@@ -124,6 +126,184 @@ class TestBankStatementImportLog(ERPNextTestSuite, AccountsTestMixin):
 		self.assertIsNone(get_float_amount("ABCD"))
 		self.assertIsNone(get_float_amount("****"))
 
+	# ------------------------------------------------------------------ #
+	# Amount format detection
+	# ------------------------------------------------------------------ #
+
+	def test_amount_cr_dr_marker(self):
+		"""The marker is read at either end of the cell, but only next to the amount."""
+		for amount in ("2,378.00Cr", "50.90 CR", "INR 50.90 Cr.", "1000cr", "5cr", "(100) Cr"):
+			self.assertEqual(get_amount_cr_dr_marker(amount), "cr", amount)
+
+		for amount in ("2,378.00Dr", "50.90 DR", "1000dr", "-100 Dr"):
+			self.assertEqual(get_amount_cr_dr_marker(amount), "dr", amount)
+
+		# Some banks put the marker in front of the digits instead.
+		for amount in ("Cr 100", "Cr100", "CR INR 100", "cr 0.00"):
+			self.assertEqual(get_amount_cr_dr_marker(amount), "cr", amount)
+
+		for amount in ("Dr 100", "Dr100", "Dr. 1,234.50"):
+			self.assertEqual(get_amount_cr_dr_marker(amount), "dr", amount)
+
+		for amount in ("100.00", "-2,000.00", "INR 25,236.00", "", None, 100.0):
+			self.assertIsNone(get_amount_cr_dr_marker(amount), amount)
+
+		# Text that merely starts or ends with the letters must not be read as a marker, or
+		# a description that bled into the amount column would reclassify the statement.
+		for amount in (
+			"CREDIT CARD PAYMENT 500",
+			"DRAFT 100",
+			"Dr Smith Clinic 500",
+			"DR AMBEDKAR ROAD BRANCH 500",
+			"500 CRC",
+			"Cheque Dr",
+			"Cr",
+		):
+			self.assertIsNone(get_amount_cr_dr_marker(amount), amount)
+
+	def test_sparsely_marked_cr_dr_amount_column(self):
+		"""One marker is enough to prove a CR/DR amount column - it is not a majority vote.
+
+		A real HDFC credit-card page carries 18 rows and a single "50.90Cr": the unmarked
+		rows are ordinary purchases, and only the exceptions are marked. A frequency vote
+		therefore picked "positive/negative" 17-1 and imported that lone credit as a debit.
+		"""
+		doc = self._create_bank_statement_import_log(
+			[
+				["Date", "Transaction Description", "Amount (in Rs.)"],
+				["21/07/2026", "ITC MAURYA NEW DELHI", "2,495.00"],
+				["22/07/2026", "ZOMATO LIMITED Gurugram", "1,288.68"],
+				["23/07/2026", "SWIGGY Bangalore", "532.00"],
+				["26/07/2026", "SWIGGY Bangalore", "1,043.00"],
+				["27/07/2026", "PETRO SURCHARGE WAIVER", "50.90Cr"],
+			]
+		)
+
+		self.assertEqual(doc.detected_amount_format, 'Amount column has "CR"/"DR" values')
+		# Only "Cr" appears, so it is the marked exception and unmarked rows are debits.
+		self.assertEqual(doc.total_credits, 50.90)
+		self.assertEqual(doc.total_credit_transactions, 1)
+		self.assertEqual(doc.total_debits, 5358.68)
+		self.assertEqual(doc.total_debit_transactions, 4)
+
+	def test_dr_only_statement_treats_unmarked_rows_as_deposits(self):
+		"""The mirror image of a Cr-only statement: only withdrawals are marked.
+
+		The unmarked default cannot be hardcoded to the debit, because which side gets
+		marked varies by bank. It is derived from the markers the statement actually uses -
+		here only "Dr" appears, so "Dr" is the exception and everything unmarked is a
+		deposit.
+		"""
+		doc = self._create_bank_statement_import_log(
+			[
+				["Date", "Narration", "Amount"],
+				["01/04/2026", "ATM WITHDRAWAL", "2,000.00Dr"],
+				["03/04/2026", "SALARY", "20,000.00"],
+				["05/04/2026", "INTEREST", "150.00"],
+			]
+		)
+
+		self.assertEqual(doc.detected_amount_format, 'Amount column has "CR"/"DR" values')
+		self.assertEqual(doc.total_debits, 2000.0)
+		self.assertEqual(doc.total_debit_transactions, 1)
+		self.assertEqual(doc.total_credits, 20150.0)
+		self.assertEqual(doc.total_credit_transactions, 2)
+
+	def test_leading_cr_dr_markers(self):
+		"""Some banks print the marker in front of the amount."""
+		doc = self._create_bank_statement_import_log(
+			[
+				["Date", "Narration", "Amount"],
+				["01/04/2026", "ATM WITHDRAWAL", "Dr 2,000.00"],
+				["03/04/2026", "SALARY", "Cr 20,000.00"],
+			]
+		)
+
+		self.assertEqual(doc.detected_amount_format, 'Amount column has "CR"/"DR" values')
+		self.assertEqual(doc.total_debits, 2000.0)
+		self.assertEqual(doc.total_credits, 20000.0)
+
+	def test_partially_marked_cr_dr_amount_column(self):
+		"""A CR/DR amount column stays CR/DR even when some rows carry no marker.
+
+		Every unmarked row used to also vote for "positive/negative", so an ordinary
+		statement with a few unmarked rows was detected as positive/negative and a
+		"2000.00Dr" was then imported as a deposit.
+		"""
+		doc = self._create_bank_statement_import_log(
+			[
+				["Date", "Narration", "Amount", "Balance"],
+				["01/04/2026", "OPENING FEE", "100.00", "9,900.00"],
+				["03/04/2026", "SALARY", "20000.00Cr", "29,900.00"],
+				["05/04/2026", "ATM WDL", "2000.00Dr", "27,900.00"],
+			]
+		)
+
+		self.assertEqual(doc.detected_amount_format, 'Amount column has "CR"/"DR" values')
+		# Both markers appear, so an unmarked row is undetermined and stays a debit.
+		self.assertEqual(doc.total_debits, 2100.0)
+		self.assertEqual(doc.total_debit_transactions, 2)
+		self.assertEqual(doc.total_credits, 20000.0)
+		self.assertEqual(doc.total_credit_transactions, 1)
+
+	def test_deposit_withdrawal_type_column(self):
+		"""The word Withdrawal contains "dr", so a loose CR/DR check claims this column first.
+
+		It then reads "Deposit" (which has no "cr" in it) as a withdrawal, flipping the
+		direction of every credit in the statement.
+		"""
+		doc = self._create_bank_statement_import_log(
+			[
+				["Date", "Narration", "Transaction Type", "Amount"],
+				["01/04/2026", "ATM WDL", "Withdrawal", "2,000.00"],
+				["03/04/2026", "SALARY", "Deposit", "20,000.00"],
+				["05/04/2026", "ATM WDL", "Withdrawal", "500.00"],
+			]
+		)
+
+		self.assertEqual(
+			doc.detected_amount_format, 'Transaction type column has "Deposit"/"Withdrawal" values'
+		)
+		self.assertEqual(doc.total_debits, 2500.0)
+		self.assertEqual(doc.total_debit_transactions, 2)
+		self.assertEqual(doc.total_credits, 20000.0)
+		self.assertEqual(doc.total_credit_transactions, 1)
+
+	def test_unrecognised_type_column_falls_back_to_signed_amount(self):
+		"""An unrecognised transaction type must not stop the amount being read.
+
+		No tally was incremented for these rows, so max() returned the first key -
+		"Separate columns for withdrawal and deposit" - and, with no such columns in the
+		file, every amount came through as None.
+		"""
+		doc = self._create_bank_statement_import_log(
+			[
+				["Date", "Narration", "Transaction Type", "Amount"],
+				["01/04/2026", "ATM WDL", "NEFT", "-2,000.00"],
+				["03/04/2026", "SALARY", "IMPS", "20,000.00"],
+			]
+		)
+
+		self.assertEqual(doc.detected_amount_format, "Amount column has positive/negative values")
+		self.assertEqual(doc.total_debits, 2000.0)
+		self.assertEqual(doc.total_credits, 20000.0)
+
+	def test_blank_transaction_type_cell(self):
+		"""A blank type cell used to raise - `None.lower()` - instead of parsing the row."""
+		doc = self._create_bank_statement_import_log(
+			[
+				["Date", "Narration", "Transaction Type", "Amount"],
+				["01/04/2026", "ATM WDL", "Dr", "2,000.00"],
+				["03/04/2026", "SALARY", "Cr", "20,000.00"],
+				["05/04/2026", "UNKNOWN", None, "500.00"],
+			]
+		)
+
+		self.assertEqual(doc.detected_amount_format, 'Transaction type column has "CR"/"DR" values')
+		# The unmarked row has no direction of its own, so it counts as a withdrawal.
+		self.assertEqual(doc.total_debits, 2500.0)
+		self.assertEqual(doc.total_credits, 20000.0)
+
 	# ------------------------------------------------------------------ #
 	# PDF statement import
 	# ------------------------------------------------------------------ #
@@ -159,7 +339,8 @@ class TestBankStatementImportLog(ERPNextTestSuite, AccountsTestMixin):
 		else:
 			table["header_index"] = None
 			table["column_mapping"] = guess_column_mapping_by_content(table["rows"])
-		table["included"] = True
+		final_transactions, _df, _af = build_table_transactions(table)
+		table["included"] = should_include_table(table, final_transactions)
 		return table
 
 	def test_pdf_multi_page_kept_separate_and_unioned(self):
@@ -197,6 +378,74 @@ class TestBankStatementImportLog(ERPNextTestSuite, AccountsTestMixin):
 		final, _df, _af = build_table_transactions(ad_table)
 		self.assertEqual(final, [])
 
+	def test_pdf_summary_box_not_auto_included(self):
+		"""A summary box that happens to parse as one transaction must not start included.
+
+		The "Payment Due Date / Total Dues / Minimum Amount Due" block on an HDFC
+		credit-card statement has a date column and a figures column, so it yields a single
+		transaction - the due date and the minimum amount - and used to import as a phantom
+		row. What it does not have, and a real transaction table always does, is a narration.
+		"""
+		summary_box = {
+			"header_index": 1,
+			"rows": [
+				["Statement Date:17/08/2025", "Card No: 4341 55XX XXXX 2754", ""],
+				["Payment Due Date", "Total Dues", "Minimum Amount Due"],
+				["06/09/2025", "73,200.00", "3,660.00"],
+				["Credit Limit", "Available Credit Limit", "Available Cash Limit"],
+				["", "32,800", ""],
+			],
+			"column_mapping": [
+				{"index": 0, "header_text": "Payment Due Date", "variable": "a", "maps_to": "Date"},
+				{"index": 1, "header_text": "Total Dues", "variable": "b", "maps_to": "Do not import"},
+				{"index": 2, "header_text": "Minimum Amount Due", "variable": "c", "maps_to": "Amount"},
+			],
+		}
+
+		final, _df, _af = build_table_transactions(summary_box)
+		# It really does parse as a transaction - that is why the previous check missed it.
+		self.assertEqual(len(final), 1)
+		self.assertFalse(should_include_table(summary_box, final))
+
+		# The transaction table beside it, which does carry a narration, still starts included.
+		transactions = self._auto_map(
+			{
+				"rows": [
+					["Date", "Transaction Description", "Amount (in Rs.)"],
+					["21/07/2025", "ITC MAURYA NEW DELHI", "2,495.00"],
+					["27/07/2025", "PETRO SURCHARGE WAIVER", "50.90Cr"],
+				]
+			}
+		)
+		self.assertTrue(transactions["included"])
+
+	def test_pdf_table_without_description_still_importable(self):
+		"""No narration column means "starts unticked", NOT "cannot be imported".
+
+		`description` is not mandatory on Bank Transaction, so a bank that omits narration
+		must still import once the user ticks the table.
+		"""
+		table = {
+			"header_index": 0,
+			"rows": [
+				["Date", "Amount", "Balance"],
+				["01/04/2025", "500.00", "9,500.00"],
+				["03/04/2025", "20000.00", "29,500.00"],
+			],
+			"column_mapping": [
+				{"index": 0, "header_text": "Date", "variable": "a", "maps_to": "Date"},
+				{"index": 1, "header_text": "Amount", "variable": "b", "maps_to": "Amount"},
+				{"index": 2, "header_text": "Balance", "variable": "c", "maps_to": "Balance"},
+			],
+		}
+
+		final, _df, _af = build_table_transactions(table)
+		self.assertFalse(should_include_table(table, final))
+
+		# The transactions themselves are intact and importable.
+		self.assertEqual(len(final), 2)
+		self.assertEqual([t["date"] for t in final], ["2025-04-01", "2025-04-03"])
+
 	def test_headerless_content_mapping(self):
 		"""Without a header row, columns are guessed from their contents."""
 		rows = [

erpnext/accounts/doctype/bank_transaction/bank_transaction_upload.py

@@ -11,6 +11,10 @@ from frappe.utils.dateutils import parse_date
 
 @frappe.whitelist()
 def upload_bank_statement():
+	# Parsing a statement is the first step of creating Bank Transactions from it. Both functions here
+	# are reached only over HTTP, so there is no in-process caller to break.
+	frappe.has_permission("Bank Transaction", "create", throw=True)
+
 	if getattr(frappe, "uploaded_file", None):
 		with open(frappe.uploaded_file, "rb") as upfile:
 			fcontent = upfile.read()
@@ -34,8 +38,13 @@ def upload_bank_statement():
 	return {"columns": columns, "data": data}
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def create_bank_entries(columns, data, bank_account):
+	# insert()/submit() enforce this per document, but only after the loop has read each Bank Account
+	# and written an Error Log per rejected row. Check once up front.
+	frappe.has_permission("Bank Transaction", "create", throw=True)
+	frappe.has_permission("Bank Account", doc=bank_account, throw=True)
+
 	header_map = get_header_mapping(columns, bank_account)
 
 	success = 0

erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py

@@ -8,6 +8,7 @@ from functools import reduce
 
 import frappe
 from frappe import _
+from frappe.core.doctype.file.utils import find_file_by_url
 from frappe.desk.form.linked_with import get_linked_fields
 from frappe.model.document import Document
 from frappe.utils import cint, cstr
@@ -58,6 +59,8 @@ def validate_columns(data):
 
 @frappe.whitelist()
 def validate_company(company):
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	parent_company, allow_account_creation_against_child_company = frappe.get_cached_value(
 		"Company", company, ["parent_company", "allow_account_creation_against_child_company"]
 	)
@@ -110,7 +113,10 @@ def import_coa(file_name, company):
 
 
 def get_file(file_name):
-	file_doc = frappe.get_doc("File", {"file_url": file_name})
+	file_doc = find_file_by_url(file_name)
+	if not file_doc:
+		raise frappe.PermissionError
+
 	parts = file_doc.get_extension()
 	extension = parts[1]
 	extension = extension.lstrip(".")
@@ -177,6 +183,8 @@ def generate_data_from_excel(file_doc, extension, as_dict=False):
 def get_coa(doctype, parent, is_root=False, file_name=None, for_validate=0):
 	"""called by tree view (to fetch node's children)"""
 
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	file_doc, extension = get_file(file_name)
 	parent = None if parent == _("All Accounts") else parent
 
@@ -324,6 +332,8 @@ def build_response_as_excel(writer):
 
 @frappe.whitelist()
 def download_template(file_type, template_type, company):
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	writer = get_template(template_type, company)
 
 	if file_type == "CSV":
@@ -376,7 +386,6 @@ def get_sample_template(writer, company):
 	return writer
 
 
-@frappe.whitelist()
 def validate_accounts(file_doc, extension):
 	if extension == "csv":
 		accounts = generate_data_from_csv(file_doc, as_dict=True)

erpnext/accounts/doctype/cost_center/cost_center.json

@@ -126,7 +126,7 @@
  "idx": 1,
  "is_tree": 1,
  "links": [],
- "modified": "2026-04-14 18:15:27.367298",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Cost Center",
@@ -181,6 +181,54 @@
   {
    "role": "HR Manager",
    "select": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing User",
+   "select": 1
+  },
+  {
+   "role": "Projects Manager",
+   "select": 1
+  },
+  {
+   "role": "Projects User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/coupon_code/coupon_code.js

@@ -5,7 +5,10 @@ frappe.ui.form.on("Coupon Code", {
 	setup: function (frm) {
 		frm.set_query("pricing_rule", function () {
 			return {
-				filters: [["Pricing Rule", "coupon_code_based", "=", "1"]],
+				filters: {
+					coupon_code_based: 1,
+					disable: 0,
+				},
 			};
 		});
 	},

erpnext/accounts/doctype/coupon_code/coupon_code.json

@@ -125,7 +125,7 @@
   }
  ],
  "links": [],
- "modified": "2024-11-19 16:35:11.836441",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Coupon Code",
@@ -179,6 +179,14 @@
    "role": "Website Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
   }
  ],
  "sort_field": "creation",

erpnext/accounts/doctype/coupon_code/coupon_code.py

@@ -42,7 +42,23 @@ class CouponCode(Document):
 				self.coupon_code = frappe.generate_hash()[:10].upper()
 
 	def validate(self):
+		self.validate_from_to_dates("valid_from", "valid_upto")
+		self.validate_pricing_rule()
+
 		if self.coupon_type == "Gift Card":
 			self.maximum_use = 1
 			if not self.customer:
 				frappe.throw(_("Please select the customer."))
+
+	def validate_pricing_rule(self):
+		if not self.pricing_rule or self.from_external_ecomm_platform:
+			return
+
+		# Allow existing coupons to be updated after their pricing rule is disabled.
+		if not (
+			self.has_value_changed("pricing_rule") or self.has_value_changed("from_external_ecomm_platform")
+		):
+			return
+
+		if frappe.db.get_value("Pricing Rule", self.pricing_rule, "disable"):
+			frappe.throw(_("Pricing Rule {0} is disabled").format(frappe.bold(self.pricing_rule)))

erpnext/accounts/doctype/coupon_code/test_coupon_code.py

@@ -113,6 +113,43 @@ class TestCouponCode(ERPNextTestSuite):
 	def setUp(self):
 		test_create_test_data()
 
+	def test_disabled_pricing_rule_validation(self):
+		coupon = frappe.get_doc("Coupon Code", "SAVE30")
+		rule = frappe.get_doc("Pricing Rule", coupon.pricing_rule)
+		rule.disable = 1
+		rule.save()
+
+		with self.subTest("new coupon cannot select a disabled rule"):
+			new_coupon = frappe.copy_doc(coupon)
+			new_coupon.coupon_name = "Festival Savings"
+			new_coupon.coupon_code = "FESTSAVE"
+			with self.assertRaisesRegex(frappe.ValidationError, "is disabled"):
+				new_coupon.insert()
+
+		with self.subTest("existing coupon can retain a disabled rule"):
+			coupon.description = "Offer paused"
+			coupon.save()
+			coupon.reload()
+			self.assertEqual(coupon.description, "Offer paused")
+			self.assertEqual(coupon.pricing_rule, rule.name)
+
+		with self.subTest("existing coupon cannot switch to a disabled rule"):
+			disabled_rule = frappe.copy_doc(rule)
+			disabled_rule.insert()
+			coupon.reload()
+			coupon.pricing_rule = disabled_rule.name
+			with self.assertRaisesRegex(frappe.ValidationError, "is disabled"):
+				coupon.save()
+			coupon.reload()
+			self.assertEqual(coupon.pricing_rule, rule.name)
+
+	def test_cannot_save_coupon_with_reversed_validity_dates(self):
+		coupon = frappe.get_doc("Coupon Code", "SAVE30")
+		coupon.valid_from = "2026-09-17"
+		coupon.valid_upto = "2026-09-02"
+		with self.assertRaises(frappe.exceptions.InvalidDates):
+			coupon.save()
+
 	def test_sales_order_with_coupon_code(self):
 		frappe.db.set_value("Coupon Code", "SAVE30", "used", 0)
 

erpnext/accounts/doctype/dunning/dunning.js

@@ -234,8 +234,10 @@ frappe.ui.form.on("Dunning", {
 				dn: frm.doc.name,
 			},
 			callback: function (r) {
-				var doc = frappe.model.sync(r.message);
-				frappe.set_route("Form", doc[0].doctype, doc[0].name);
+				if (!r.exc) {
+					var doc = frappe.model.sync(r.message);
+					frappe.set_route("Form", doc[0].doctype, doc[0].name);
+				}
 			},
 		});
 	},

erpnext/accounts/doctype/dunning/dunning.py

@@ -17,7 +17,8 @@ import json
 import frappe
 from frappe import _
 from frappe.contacts.doctype.address.address import get_address_display
-from frappe.utils import getdate
+from frappe.query_builder.functions import Sum
+from frappe.utils import flt, getdate
 
 from erpnext.controllers.accounts_controller import AccountsController
 
@@ -147,6 +148,31 @@ class Dunning(AccountsController):
 			)
 			row.dunning_level = len(past_dunnings) + 1
 
+	def get_unpaid_base_dunning_amount(self):
+		"""Interest and dunning fee that is still to be collected, in company currency."""
+		if not self.base_dunning_amount:
+			return 0.0
+
+		return flt(
+			flt(self.base_dunning_amount) - get_paid_dunning_amount(self.name),
+			self.precision("base_dunning_amount"),
+		)
+
+	def get_unpaid_dunning_amount(self):
+		"""Interest and dunning fee that is still to be collected, in the dunning currency."""
+		return flt(
+			self.get_unpaid_base_dunning_amount() / (flt(self.conversion_rate) or 1),
+			self.precision("dunning_amount"),
+		)
+
+	def get_unpaid_overdue_payments(self):
+		"""Overdue payments with their outstanding as of now, not as of dunning creation."""
+		return [
+			(row, outstanding)
+			for row in self.overdue_payments
+			if (outstanding := get_current_outstanding(row)) > 0
+		]
+
 	def on_cancel(self):
 		super().on_cancel()
 		self.ignore_linked_doctypes = [
@@ -161,6 +187,7 @@ class Dunning(AccountsController):
 			"Unreconcile Payment Entries",
 			"Payment Ledger Entry",
 			"Serial and Batch Bundle",
+			"Payment Entry",
 		]
 
 	@frappe.whitelist()
@@ -259,11 +286,73 @@ def update_linked_dunnings(doc, previous_outstanding_amount):
 			if has_outstanding:
 				break
 
-		new_status = "Resolved" if not has_outstanding else "Unresolved"
+		set_dunning_status(dunning, has_outstanding, respect_manual_resolution=True)
 
-		if dunning.status != new_status:
-			dunning.status = new_status
-			dunning.save()
+
+def update_dunnings_linked_to_payment(payment_entry):
+	"""Refresh dunnings whose interest and fee are settled by this payment."""
+	dunnings = {row.dunning for row in payment_entry.get("deductions") if row.dunning}
+
+	for name in dunnings:
+		dunning = frappe.get_doc("Dunning", name)
+		if dunning.docstatus != 1:
+			continue
+
+		set_dunning_status(dunning, bool(dunning.get_unpaid_overdue_payments()))
+
+
+def set_dunning_status(dunning, has_outstanding_payments: bool, respect_manual_resolution: bool = False):
+	"""A dunning is only resolved once the invoiced sum *and* its interest and fee are paid."""
+	has_unpaid_dunning_amount = dunning.get_unpaid_dunning_amount() > 0
+	new_status = "Unresolved" if has_outstanding_payments or has_unpaid_dunning_amount else "Resolved"
+
+	# resolving by hand waives the interest, only an invoice that is owed again reopens it
+	if respect_manual_resolution and dunning.status == "Resolved" and not has_outstanding_payments:
+		return
+
+	if dunning.status != new_status:
+		dunning.db_set("status", new_status, notify=True)
+
+
+def get_paid_dunning_amount(dunning: str) -> float:
+	"""Interest and fee collected for this dunning, in company currency."""
+	deduction = frappe.qb.DocType("Payment Entry Deduction")
+	payment_entry = frappe.qb.DocType("Payment Entry")
+
+	paid = (
+		frappe.qb.from_(deduction)
+		.join(payment_entry)
+		.on(payment_entry.name == deduction.parent)
+		.select(Sum(deduction.amount))
+		.where((deduction.dunning == dunning) & (payment_entry.docstatus == 1))
+	).run()
+
+	# the dunning amount is booked as a negative deduction, against the income account
+	return -flt(paid[0][0]) if paid else 0.0
+
+
+def get_current_outstanding(overdue_payment) -> float:
+	"""Outstanding of an overdue payment as of now, in the invoice's transaction currency."""
+	invoice = frappe.db.get_value(
+		"Sales Invoice",
+		overdue_payment.sales_invoice,
+		["outstanding_amount", "currency", "party_account_currency"],
+		as_dict=True,
+	)
+	schedule_outstanding = (
+		flt(frappe.db.get_value("Payment Schedule", overdue_payment.payment_schedule, "outstanding"))
+		if overdue_payment.payment_schedule
+		else flt(overdue_payment.outstanding)
+	)
+
+	if flt(invoice.outstanding_amount) <= 0 or schedule_outstanding <= 0:
+		return 0.0
+
+	outstanding = min(schedule_outstanding, flt(overdue_payment.outstanding))
+	if invoice.currency == invoice.party_account_currency:
+		outstanding = min(outstanding, flt(invoice.outstanding_amount))
+
+	return outstanding
 
 
 def get_linked_dunnings_as_per_state(sales_invoice, state):
@@ -275,6 +364,7 @@ def get_linked_dunnings_as_per_state(sales_invoice, state):
 		.join(overdue_payment)
 		.on(overdue_payment.parent == dunning.name)
 		.select(dunning.name)
+		.distinct()
 		.where(
 			(dunning.status == state)
 			& (dunning.docstatus != 2)

erpnext/accounts/doctype/dunning/test_dunning.py

@@ -12,6 +12,7 @@ from erpnext.accounts.doctype.sales_invoice.sales_invoice import (
 	create_dunning as create_dunning_from_sales_invoice,
 )
 from erpnext.accounts.doctype.sales_invoice.test_sales_invoice import (
+	create_sales_invoice,
 	create_sales_invoice_against_cost_center,
 )
 from erpnext.tests.utils import ERPNextTestSuite
@@ -54,6 +55,123 @@ class TestDunning(ERPNextTestSuite):
 		dunning.reload()
 		self.assertEqual(dunning.status, "Resolved")
 
+	def test_dunning_not_resolved_by_payment_of_invoiced_sum_only(self):
+		"""
+		Regression for #58220: paying the invoice without the interest and fee must not
+		resolve the dunning, the interest is still owed and has to stay claimable.
+		"""
+		dunning = create_dunning(overdue_days=15, dunning_type_name="Second Notice - _TC")
+		dunning.submit()
+		sales_invoice = dunning.overdue_payments[0].sales_invoice
+
+		pe = get_payment_entry("Sales Invoice", sales_invoice)
+		pe.reference_no, pe.reference_date = "4", nowdate()
+		pe.insert()
+		pe.submit()
+
+		self.assertEqual(frappe.get_value("Sales Invoice", sales_invoice, "outstanding_amount"), 0)
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Unresolved")
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+		# the interest and fee can still be collected on their own
+		pe = get_payment_entry("Dunning", dunning.name)
+		pe.reference_no, pe.reference_date = "5", nowdate()
+		self.assertEqual(pe.references, [])
+		self.assertEqual(round(pe.paid_amount, 2), 10.41)
+		pe.insert()
+		pe.submit()
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Resolved")
+		self.assertEqual(dunning.get_unpaid_dunning_amount(), 0)
+
+		# cancelling the interest payment makes the dunning claimable again
+		pe.cancel()
+		dunning.reload()
+		self.assertEqual(dunning.status, "Unresolved")
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+	def test_dunning_can_be_cancelled_after_its_interest_was_paid(self):
+		"""
+		The payment collecting the interest links back to the dunning, which must not stand in
+		the way of cancelling it.
+		"""
+		dunning = create_dunning(overdue_days=15, dunning_type_name="Second Notice - _TC")
+		dunning.submit()
+
+		pe = get_payment_entry("Dunning", dunning.name)
+		pe.reference_no, pe.reference_date = "6", nowdate()
+		pe.insert()
+		pe.submit()
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Resolved")
+
+		dunning.cancel()
+		self.assertEqual(dunning.docstatus, 2)
+
+	def test_waived_interest_keeps_a_manually_resolved_dunning_resolved(self):
+		"""
+		Resolving a dunning by hand waives its interest, so a later payment of the invoice
+		must not reopen it.
+		"""
+		dunning = create_dunning(overdue_days=15, dunning_type_name="Second Notice - _TC")
+		dunning.submit()
+		sales_invoice = dunning.overdue_payments[0].sales_invoice
+
+		# what the "Resolve" button does
+		dunning.reload()
+		dunning.status = "Resolved"
+		dunning.save()
+
+		pe = get_payment_entry("Sales Invoice", sales_invoice)
+		pe.reference_no, pe.reference_date = "7", nowdate()
+		pe.insert()
+		pe.submit()
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Resolved")
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+	def test_unpaid_dunning_amount_is_tracked_in_company_currency(self):
+		"""
+		The interest and fee are collected as a Payment Entry deduction, a company currency
+		field, so what is left to collect has to be measured in the same currency.
+		"""
+		si = create_sales_invoice(
+			posting_date=add_days(today(), -15),
+			customer="_Test Customer USD",
+			currency="USD",
+			conversion_rate=50,
+			rate=100,
+			debit_to="_Test Receivable USD - _TC",
+		)
+
+		dunning = create_dunning_from_sales_invoice(si.name)
+		dunning_type = frappe.get_doc("Dunning Type", "Second Notice - _TC")
+		dunning.dunning_type = dunning_type.name
+		dunning.rate_of_interest = dunning_type.rate_of_interest
+		dunning.dunning_fee = dunning_type.dunning_fee
+		dunning.income_account = dunning_type.income_account
+		dunning.cost_center = dunning_type.cost_center
+		dunning.save()
+
+		self.assertEqual(dunning.currency, "USD")
+		self.assertEqual(dunning.conversion_rate, 50)
+		self.assertEqual(round(dunning.dunning_amount, 2), 10.41)
+		self.assertEqual(round(dunning.base_dunning_amount, 2), 520.55)
+
+		# nothing collected yet, in either currency
+		self.assertEqual(round(dunning.get_unpaid_base_dunning_amount(), 2), 520.55)
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+		# the deduction booking the interest is in company currency
+		dunning.submit()
+		pe = get_payment_entry("Dunning", dunning.name)
+		self.assertEqual(round(pe.deductions[0].amount, 2), -520.55)
+
 	def test_fetch_overdue_payments(self):
 		"""
 		Create SI with overdue payment. Check if overdue payment is fetched in Dunning.
@@ -122,6 +240,41 @@ class TestDunning(ERPNextTestSuite):
 		self.assertEqual(sales_invoice.status, "Overdue")
 		self.assertEqual(dunning.status, "Unresolved")
 
+	def test_payment_against_invoice_with_multiple_overdue_installments_in_dunning(self):
+		"""
+		When an invoice has more than one overdue installment, its Dunning holds one
+		Overdue Payment row per installment. Submitting a Payment Entry for the invoice
+		must resolve the Dunning without raising a TimestampMismatchError caused by the
+		same Dunning being loaded and saved more than once.
+		"""
+		create_payment_terms_template_for_dunning()
+		# Post far enough in the past that BOTH installments (5 and 10 credit days) are overdue.
+		sales_invoice = create_sales_invoice_against_cost_center(
+			posting_date=add_days(today(), -15),
+			qty=1,
+			rate=100,
+			do_not_submit=True,
+		)
+		sales_invoice.payment_terms_template = "_Test 50-50 for Dunning"
+		sales_invoice.submit()
+
+		dunning = create_dunning_from_sales_invoice(sales_invoice.name)
+		# Two overdue installments -> two overdue payment rows for the same invoice.
+		self.assertEqual(len(dunning.overdue_payments), 2)
+		dunning.submit()
+		self.assertEqual(dunning.status, "Unresolved")
+
+		# Pay the invoice in full. This previously raised TimestampMismatchError on the Dunning.
+		pe = get_payment_entry("Sales Invoice", sales_invoice.name)
+		pe.reference_no, pe.reference_date = "3", nowdate()
+		pe.insert()
+		pe.submit()
+
+		sales_invoice.reload()
+		dunning.reload()
+		self.assertEqual(sales_invoice.outstanding_amount, 0)
+		self.assertEqual(dunning.status, "Resolved")
+
 	def test_dunning_resolution_from_credit_note(self):
 		"""
 		Test that dunning is resolved when a credit note is issued against the original invoice.

erpnext/accounts/doctype/finance_book/finance_book.json

@@ -20,7 +20,7 @@
  ],
  "icon": "fa fa-book",
  "links": [],
- "modified": "2024-03-27 13:09:44.514241",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Finance Book",
@@ -55,6 +55,18 @@
    "report": 1,
    "role": "Auditor",
    "share": 1
+  },
+  {
+   "role": "HR Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/financial_report_template/financial_report_engine.py

@@ -31,6 +31,7 @@ from erpnext.accounts.doctype.financial_report_template.financial_report_validat
 	AccountFilterValidator,
 	CalculationFormulaValidator,
 	DependencyValidator,
+	get_valid_api_method,
 )
 from erpnext.accounts.report.financial_statements import (
 	get_columns,
@@ -478,7 +479,10 @@ class DataCollector:
 		if company:
 			query = query.where(account.company == company)
 
-		if conditions := filter_parser.build_conditions(account_rows, account):
+		# filters are optional: no filter means all (enabled, non-group) accounts of the company.
+		# invalid filters can't reach here — build_conditions raises on them (raise_on_invalid).
+		conditions = filter_parser.build_conditions(account_rows, account, raise_on_invalid=True)
+		if conditions is not None:
 			query = query.where(conditions)
 
 		return query.run(pluck=True)
@@ -790,17 +794,20 @@ class FilterExpressionParser:
 	def __init__(self):
 		self.validator = AccountFilterValidator()
 
-	def build_conditions(self, report_rows, table):
+	def build_conditions(self, report_rows, table, raise_on_invalid=False):
 		conditions = []
 		for row in report_rows or []:
-			condition = self.build_condition(row, table)
+			condition = self.build_condition(row, table, raise_on_invalid=raise_on_invalid)
 			if condition is not None:
 				conditions.append(condition)
 
+		if not conditions:
+			return None
+
 		# ensure brackets in or condition
 		return reduce(lambda a, b: (a) | (b), conditions)
 
-	def build_condition(self, report_row, table):
+	def build_condition(self, report_row, table, raise_on_invalid=False):
 		"""
 		Build SQL condition directly from filter formula.
 
@@ -830,9 +837,11 @@ class FilterExpressionParser:
 		if not filter_formula:
 			return None
 
-		errors = self.validator.validate(report_row)
+		errors = self.validator.validate_filter(report_row)
 		if not errors.is_valid:
 			error_messages = [str(issue) for issue in errors.issues]
+			if raise_on_invalid:
+				frappe.throw("<br><br>".join(error_messages), title=_("Invalid Filter"))
 			frappe.log_error(f"Filter validation errors found:\n{'<br><br>'.join(error_messages)}")
 			return None
 
@@ -1022,7 +1031,11 @@ class FormulaFieldUpdater:
 
 @frappe.whitelist()
 def get_filtered_accounts(company: str, account_rows: str | list):
+	if not company:
+		frappe.throw(_("Company is required"), title=_("Missing Company"))
+
 	frappe.has_permission("Financial Report Template", ptype="read", throw=True)
+	frappe.has_permission("Company", doc=company, throw=True)
 
 	if isinstance(account_rows, str):
 		account_rows = json.loads(account_rows, object_hook=frappe._dict)
@@ -1164,10 +1177,12 @@ class RowProcessor:
 
 	def _process_api_row(self, row) -> RowData:
 		api_path = row.calculation_formula
-		# TODO
+
+		method = get_valid_api_method(api_path)
 
 		try:
-			values = frappe.call(api_path, filters=self.context.filters, periods=self.period_list, row=row)
+			# nosemgrep: frappe-semgrep-rules.rules.security.frappe-codeinjection-eval
+			values = frappe.call(method, filters=self.context.filters, periods=self.period_list, row=row)
 
 			if row.reverse_sign:
 				values = [-1 * v for v in values]

erpnext/accounts/doctype/financial_report_template/financial_report_template.js

@@ -163,7 +163,7 @@ function show_accounts_tree(template_rows, has_selection) {
 				fieldname: "company",
 				fieldtype: "Link",
 				options: "Company",
-				label: "Company",
+				label: __("Company"),
 				reqd: 1,
 				default: frappe.defaults.get_user_default("Company"),
 				onchange: () => {
@@ -176,7 +176,7 @@ function show_accounts_tree(template_rows, has_selection) {
 				fieldname: "view_type",
 				fieldtype: "Select",
 				options: ["Missing Accounts", "Filtered Accounts"],
-				label: "View",
+				label: __("View"),
 				default: has_selection ? "Filtered Accounts" : "Missing Accounts",
 				reqd: 1,
 				onchange: () => {
@@ -192,10 +192,10 @@ function show_accounts_tree(template_rows, has_selection) {
 			{
 				fieldname: "tip",
 				fieldtype: "HTML",
-				label: "Tip",
+				label: __("Tip"),
 				options: `
 					<div class="alert alert-success" role="alert">
-							Tip: Select report lines to view their accounts
+							${__("Tip: Select report lines to view their accounts")}
 					</div>
 				`,
 				depends_on: has_selection ? "eval: false" : "eval: true",
@@ -203,7 +203,7 @@ function show_accounts_tree(template_rows, has_selection) {
 			{
 				fieldname: "tree_area",
 				fieldtype: "HTML",
-				label: "Chart of Accounts",
+				label: __("Chart of Accounts"),
 				read_only: 1,
 				depends_on: "eval: doc.company",
 			},
@@ -288,14 +288,14 @@ function update_formula_label(frm, data_source) {
 	if (!field) return;
 
 	const labels = {
-		"Account Data": "Account Filter",
-		"Custom API": "API Method Path",
+		"Account Data": __("Account Filter"),
+		"Custom API": __("API Method Path"),
 	};
 
 	grid.update_docfield_property(
 		"calculation_formula",
 		"label",
-		labels[data_source] || "Calculation Formula"
+		labels[data_source] || __("Calculation Formula")
 	);
 }
 
@@ -370,7 +370,7 @@ function update_formula_description(frm, data_source) {
 		description_html = `
 			<div ${container_style}>
 				<h5 ${title_style}>Custom API Setup</h5>
-				<p ${text_style}>Path to your custom method that returns financial data.</p>
+				<p ${text_style}>Path to your custom whitelisted method that returns financial data. It must permit GET requests.</p>
 
 				<h6 ${subtitle_style}>Format:</h6>
 				<ul ${list_style}>
@@ -380,7 +380,8 @@ function update_formula_description(frm, data_source) {
 
 				<h6 ${subtitle_style}>Method Signature:</h6>
 				<div ${code_style}>
-					<pre ${pre_style}>def get_custom_data(filters, periods, row): <br>&nbsp; # filters: dict — report filters (company, period, etc.) <br>&nbsp; # periods: list[dict] — period definitions <br>&nbsp; # row: dict — the current report row <br><br>&nbsp; return [1000.0, 1200.0, 1150.0]  # one value per period</pre>
+					<!-- &#10; is used for line breaks since frappe.render replaces newlines with spaces -->
+					<pre ${pre_style} class="language-python">@frappe.whitelist(methods=["GET"])&#10;def get_custom_data(filters, periods, row):&#10;    # filters: dict — report filters (company, period, etc.)&#10;    # periods: list[dict] — period definitions&#10;    # row: dict — the current report row&#10;&#10;    return [1000.0, 1200.0, 1150.0]  # one value per period</pre>
 				</div>
 
 				<h6 ${subtitle_style}>Return Format:</h6>

erpnext/accounts/doctype/financial_report_template/financial_report_validation.py

@@ -10,18 +10,41 @@ from enum import Enum
 from typing import Any, ClassVar
 
 import frappe
-from frappe import _
+from frappe import _, is_whitelisted
 from frappe.database.operator_map import OPERATOR_MAP
 from frappe.database.query import SQLFunctionParser
 
 
+def get_valid_api_method(api_path: str):
+	"""Resolve `api_path`, ensuring it is whitelisted and permits GET (i.e. read-only)."""
+	method = frappe.get_attr(api_path)
+	is_whitelisted(method)
+
+	if "GET" not in frappe.allowed_http_methods_for_whitelisted_func.get(method, ()):
+		frappe.throw(
+			_("Method {0} must permit GET requests").format(frappe.bold(api_path)),
+			frappe.PermissionError,
+			title=_("Method Not Allowed"),
+		)
+
+	return method
+
+
+def get_formula_field_label(data_source: str) -> str:
+	# Must mirror the `labels` map in financial_report_template.js (update_formula_label),
+	labels = {
+		"Account Data": _("Account Filter"),
+		"Custom API": _("API Method Path"),
+	}
+	return labels.get(data_source, _("Calculation Formula"))
+
+
 @dataclass
 class ValidationIssue:
 	"""Represents a single validation issue"""
 
 	message: str
 	row_idx: int | None = None
-	field: str | None = None
 	details: dict[str, Any] = None
 
 	def __post_init__(self):
@@ -29,10 +52,9 @@ class ValidationIssue:
 			self.details = {}
 
 	def __str__(self) -> str:
-		prefix = f"Row {self.row_idx}: " if self.row_idx else ""
-		field_info = f"[{self.field}] " if self.field else ""
-		message = f"{prefix}{field_info}{self.message}"
-		return _(message)
+		if self.row_idx:
+			return _("Row {0}: {1}", context="Financial Report Template").format(self.row_idx, self.message)
+		return self.message
 
 
 @dataclass
@@ -134,7 +156,9 @@ class TemplateStructureValidator(Validator):
 			if not re.match(r"^[A-Za-z][A-Za-z0-9_-]*$", ref_code):
 				result.add_error(
 					ValidationIssue(
-						message=f"Invalid line reference format: '{ref_code}'. Must start with letter and contain only letters, numbers, underscores, and hyphens",
+						message=_(
+							"Invalid line reference format: '{0}'. Must start with letter and contain only letters, numbers, underscores, and hyphens"
+						).format(ref_code),
 						row_idx=row.idx,
 					)
 				)
@@ -143,7 +167,7 @@ class TemplateStructureValidator(Validator):
 			if ref_code in used_codes:
 				result.add_error(
 					ValidationIssue(
-						message=f"Duplicate line reference: '{ref_code}'",
+						message=_("Duplicate line reference: '{0}'").format(ref_code),
 						row_idx=row.idx,
 					)
 				)
@@ -159,7 +183,7 @@ class TemplateStructureValidator(Validator):
 			if row.data_source == "Account Data" and not row.balance_type:
 				result.add_error(
 					ValidationIssue(
-						message="Balance Type is required for Account Data",
+						message=_("Balance Type is required for Account Data"),
 						row_idx=row.idx,
 					)
 				)
@@ -169,7 +193,11 @@ class TemplateStructureValidator(Validator):
 				if not row.calculation_formula:
 					result.add_error(
 						ValidationIssue(
-							message=f"Formula is required for {row.data_source}",
+							message=_("{0} is required when {1} is {2}").format(
+								get_formula_field_label(row.data_source),
+								row.meta.get_translated_label("data_source"),
+								_(row.data_source),
+							),
 							row_idx=row.idx,
 						)
 					)
@@ -196,7 +224,14 @@ class DependencyValidator(Validator):
 
 		for row in self.template.rows:
 			if row.reference_code and row.data_source == "Calculated Amount" and row.calculation_formula:
-				deps = extract_reference_codes_from_formula(row.calculation_formula, list(available_codes))
+				# skip self-reference, `CalculationFormulaValidator` already reports it
+				deps = [
+					code
+					for code in extract_reference_codes_from_formula(
+						row.calculation_formula, list(available_codes)
+					)
+					if code != row.reference_code
+				]
 				if deps:
 					graph[row.reference_code] = deps
 
@@ -226,7 +261,7 @@ class DependencyValidator(Validator):
 				cycle = [*path[cycle_start:], node]
 				result.add_error(
 					ValidationIssue(
-						message=f"Circular dependency detected: {' → '.join(cycle)}",
+						message=_("Circular dependency detected: {0}").format(" → ".join(cycle)),
 					)
 				)
 				return
@@ -258,7 +293,9 @@ class DependencyValidator(Validator):
 				row_idx = self._get_row_idx(ref_code)
 				result.add_error(
 					ValidationIssue(
-						message=f"Line References undefined in Formula: {', '.join(undefined)}",
+						message=_("Line references undefined in {0}: {1}").format(
+							get_formula_field_label("Calculated Amount"), ", ".join(undefined)
+						),
 						row_idx=row_idx,
 					)
 				)
@@ -285,16 +322,6 @@ class CalculationFormulaValidator(Validator):
 		if row.data_source != "Calculated Amount":
 			return result
 
-		if not row.calculation_formula:
-			result.add_error(
-				ValidationIssue(
-					message="Formula is required for Calculated Amount",
-					row_idx=row.idx,
-					field="Formula",
-				)
-			)
-			return result
-
 		formula = self._preprocess_formula(row.calculation_formula)
 		row.calculation_formula = formula
 
@@ -302,7 +329,7 @@ class CalculationFormulaValidator(Validator):
 		if not self._are_parentheses_balanced(formula):
 			result.add_error(
 				ValidationIssue(
-					message="Formula has unbalanced parentheses",
+					message=_("Formula has unbalanced parentheses"),
 					row_idx=row.idx,
 				)
 			)
@@ -314,17 +341,7 @@ class CalculationFormulaValidator(Validator):
 		if row.reference_code and row.reference_code in refs:
 			result.add_error(
 				ValidationIssue(
-					message=f"Formula references itself ('{row.reference_code}')",
-					row_idx=row.idx,
-				)
-			)
-
-		# Check undefined references
-		undefined = set(refs) - set(available_codes)
-		if undefined:
-			result.add_error(
-				ValidationIssue(
-					message=f"Formula references undefined codes: {', '.join(undefined)}",
+					message=_("Formula references itself ('{0}')").format(row.reference_code),
 					row_idx=row.idx,
 				)
 			)
@@ -334,7 +351,7 @@ class CalculationFormulaValidator(Validator):
 		if eval_error:
 			result.add_error(
 				ValidationIssue(
-					message=f"Formula evaluation error: {eval_error}",
+					message=_("Formula evaluation error: {0}").format(eval_error),
 					row_idx=row.idx,
 				)
 			)
@@ -371,7 +388,7 @@ class CalculationFormulaValidator(Validator):
 			result = frappe.safe_eval(formula, eval_globals=None, eval_locals=context)
 
 			if not isinstance(result, (int, float)):  # noqa: UP038
-				return f"Formula must return a numeric value, got {type(result).__name__}"
+				return _("Formula must return a numeric value, got {0}").format(type(result).__name__)
 
 			return None
 		except Exception as e:
@@ -386,20 +403,19 @@ class AccountFilterValidator(Validator):
 		self.account_fields = account_fields or set(self.account_meta._valid_columns)
 
 	def validate(self, row) -> ValidationResult:
-		result = ValidationResult()
-
+		# dispatch-path guard: only account-data rows are validated here
 		if row.data_source != "Account Data":
-			return result
+			return ValidationResult()
 
-		if not row.calculation_formula:
-			result.add_error(
-				ValidationIssue(
-					message="Account filter is required for Account Data",
-					row_idx=row.idx,
-					field="Formula",
-				)
-			)
-			return result
+		return self.validate_filter(row)
+
+	def validate_filter(self, row) -> ValidationResult:
+		"""Validate calculation_formula as an Account filter, regardless of data_source.
+
+		The caller has already decided this row is an account filter, so unlike
+		`validate()` this does not opt out based on `data_source`.
+		"""
+		result = ValidationResult()
 
 		try:
 			filter_config = json.loads(row.calculation_formula)
@@ -412,18 +428,21 @@ class AccountFilterValidator(Validator):
 			if error:
 				result.add_error(
 					ValidationIssue(
-						message=error,
+						message=_("[{0}] {1}", context="Financial Report Template").format(
+							get_formula_field_label("Account Data"), error
+						),
 						row_idx=row.idx,
-						field="Account Filter",
 					)
 				)
 
 		except json.JSONDecodeError as e:
 			result.add_error(
 				ValidationIssue(
-					message=f"Invalid JSON format: {e!s}",
+					message=_("[{0}] {1}", context="Financial Report Template").format(
+						get_formula_field_label("Account Data"),
+						_("Invalid JSON format: {0}").format(str(e)),
+					),
 					row_idx=row.idx,
-					field="Account Filter",
 				)
 			)
 
@@ -438,36 +457,35 @@ class AccountFilterValidator(Validator):
 		# simple condition: [field, operator, value]
 		if isinstance(filter_config, list):
 			if len(filter_config) != 3:
-				return "Filter must be [field, operator, value]"
+				return _("Filter must be [field, operator, value]")
 
 			field, operator, value = filter_config
 
 			if not isinstance(field, str) or not isinstance(operator, str):
-				return "Field and operator must be strings"
-
-			display = (field if advanced_filtering else self.account_meta.get_label(field)) or field
+				return _("Field and operator must be strings")
 
 			if field not in account_fields:
-				return f"Field '{display}' is not a valid Account field"
+				# escape: `field` is caller-supplied and this message renders as HTML
+				return _("Field '{0}' is not a valid Account field").format(frappe.utils.escape_html(field))
 
 			if operator.casefold() not in OPERATOR_MAP:
-				return f"Invalid operator '{operator}'"
+				return _("Invalid operator '{0}'").format(operator)
 
 			if operator in ["in", "not in"] and not isinstance(value, list):
-				return f"Operator '{operator}' requires a list value"
+				return _("Operator '{0}' requires a list value").format(operator)
 
 		# logical condition: {"and": [condition1, condition2]}
 		elif isinstance(filter_config, dict):
 			if len(filter_config) != 1:
-				return "Logical condition must have exactly one operator"
+				return _("Logical condition must have exactly one operator")
 
 			op = next(iter(filter_config.keys())).lower()
 			if op not in ["and", "or"]:
-				return "Logical operators must be 'and' or 'or'"
+				return _("Logical operators must be 'and' or 'or'")
 
 			conditions = filter_config[next(iter(filter_config.keys()))]
 			if not isinstance(conditions, list) or len(conditions) < 1:
-				return "Logical conditions need at least 1 sub-condition"
+				return _("Logical conditions need at least 1 sub-condition")
 
 			# recursive
 			for condition in conditions:
@@ -475,7 +493,7 @@ class AccountFilterValidator(Validator):
 				if error:
 					return error
 		else:
-			return "Filter must be a list or dict"
+			return _("Filter must be a list or dict")
 
 		return None
 
@@ -511,34 +529,32 @@ class FormulaValidator(Validator):
 		if "." not in api_path:
 			result.add_error(
 				ValidationIssue(
-					message="Custom API path should be in format: app.module.method",
+					message=_("{0} should be in format: app.module.method").format(
+						get_formula_field_label(row.data_source)
+					),
 					row_idx=row.idx,
-					field="Formula",
 				)
 			)
 			return result
 
-		# Method exists?
 		try:
-			module_path, method_name = api_path.rsplit(".", 1)
-			module = frappe.get_module(module_path)
-
-			if not hasattr(module, method_name):
-				result.add_error(
-					ValidationIssue(
-						message=f"Method '{method_name}' not found in module '{module_path}' (might be environment-specific)",
-						row_idx=row.idx,
-						field="Formula",
-					)
-				)
+			get_valid_api_method(api_path)
 		except Exception as e:
-			result.add_error(
-				ValidationIssue(
-					message=f"Could not validate API path: {e!s}",
-					row_idx=row.idx,
-					field="Formula",
+			if isinstance(e, frappe.PermissionError | frappe.ValidationError):
+				# frappe.throw inside get_valid_api_method logs a message that would pop up in UI
+				frappe.clear_last_message()
+
+			if isinstance(e, frappe.PermissionError):
+				message = _("[{0}] {1}", context="Financial Report Template").format(
+					get_formula_field_label(row.data_source),
+					_("Method '{0}' must be whitelisted and permit GET requests").format(api_path),
 				)
-			)
+			else:
+				message = _("Could not validate {0}: {1}").format(
+					get_formula_field_label(row.data_source), str(e)
+				)
+
+			result.add_error(ValidationIssue(message=message, row_idx=row.idx))
 
 		return result
 

erpnext/accounts/doctype/financial_report_template/test_financial_report_template.py

@@ -2,7 +2,13 @@
 # For license information, please see license.txt
 
 import frappe
+from frappe.tests.utils import whitelist_for_tests
 
+from erpnext.accounts.doctype.financial_report_template.financial_report_validation import (
+	AccountFilterValidator,
+	FormulaValidator,
+	get_valid_api_method,
+)
 from erpnext.tests.utils import ERPNextTestSuite
 
 
@@ -72,3 +78,173 @@ class FinancialReportTemplateTestCase(ERPNextTestSuite):
 			{"doctype": "Financial Report Template", "template_name": template_name, "rows": rows_data}
 		)
 		return template
+
+
+def not_whitelisted_method(**kwargs):
+	return [42.0]
+
+
+@whitelist_for_tests(methods=["POST"])
+def whitelisted_post_only_method(**kwargs):
+	return [42.0]
+
+
+@whitelist_for_tests(methods=["GET"])
+def whitelisted_get_method(**kwargs):
+	return [42.0]
+
+
+class TestCustomAPIValidation(FinancialReportTemplateTestCase):
+	"""Custom API rows must point to whitelisted methods that permit GET"""
+
+	TEST_MODULE = "erpnext.accounts.doctype.financial_report_template.test_financial_report_template"
+	NOT_WHITELISTED = f"{TEST_MODULE}.not_whitelisted_method"
+	WHITELISTED_POST_ONLY = f"{TEST_MODULE}.whitelisted_post_only_method"
+	WHITELISTED_GET = f"{TEST_MODULE}.whitelisted_get_method"
+
+	def create_api_template(self, api_path):
+		template = self.create_test_template_with_rows(
+			[
+				{
+					"reference_code": "API001",
+					"display_name": "API Row",
+					"data_source": "Custom API",
+					"calculation_formula": api_path,
+				}
+			]
+		)
+		template.report_type = "Profit and Loss Statement"
+		return template
+
+	def test_get_valid_api_method(self):
+		self.assertRaises(frappe.PermissionError, get_valid_api_method, self.NOT_WHITELISTED)
+		self.assertRaises(frappe.PermissionError, get_valid_api_method, self.WHITELISTED_POST_ONLY)
+		self.assertEqual(get_valid_api_method(self.WHITELISTED_GET), frappe.get_attr(self.WHITELISTED_GET))
+
+	def test_save_rejects_invalid_api_methods(self):
+		for api_path in (self.NOT_WHITELISTED, self.WHITELISTED_POST_ONLY):
+			template = self.create_api_template(api_path)
+			self.assertRaises(frappe.ValidationError, template.insert)
+
+	def test_save_allows_get_whitelisted_method(self):
+		template = self.create_api_template(self.WHITELISTED_GET)
+		template.insert()
+		template.delete()
+
+	def test_engine_rejects_invalid_api_methods(self):
+		from erpnext.accounts.doctype.financial_report_template.financial_report_engine import (
+			ReportContext,
+			RowProcessor,
+		)
+
+		for api_path in (self.NOT_WHITELISTED, self.WHITELISTED_POST_ONLY):
+			template = self.create_api_template(api_path)
+			context = ReportContext(template=template, filters={}, period_list=[{"key": "p1"}])
+			processor = RowProcessor(context)
+			self.assertRaises(frappe.PermissionError, processor._process_api_row, template.rows[0])
+
+	def test_engine_calls_valid_api_method(self):
+		from erpnext.accounts.doctype.financial_report_template.financial_report_engine import (
+			ReportContext,
+			RowProcessor,
+		)
+
+		template = self.create_api_template(self.WHITELISTED_GET)
+		context = ReportContext(template=template, filters={}, period_list=[{"key": "p1"}])
+		processor = RowProcessor(context)
+		row_data = processor._process_api_row(template.rows[0])
+		self.assertEqual(row_data.values, [42.0])
+
+	def test_validation_keeps_message_log_clean(self):
+		validator = FormulaValidator(frappe._dict(rows=[]))
+		message_count = len(frappe.local.message_log)
+
+		# last path raises AppNotInstalledError, which also logs a message via frappe.throw
+		for api_path in (self.NOT_WHITELISTED, self.WHITELISTED_POST_ONLY, "missing_app.api.method"):
+			row = frappe._dict(data_source="Custom API", calculation_formula=api_path, idx=1)
+			result = validator.validate(row)
+			self.assertFalse(result.is_valid)
+			self.assertEqual(len(frappe.local.message_log), message_count)
+
+
+class TestAccountFilter(FinancialReportTemplateTestCase):
+	"""Filter fields must be validated on the account-filter parser path."""
+
+	@staticmethod
+	def _row(formula, **extra):
+		return frappe._dict(calculation_formula=formula, idx=1, **extra)
+
+	def test_validate_filter_enforces_allow_list_without_data_source(self):
+		# the parser path has no `data_source`; the field allow-list must still apply
+		validator = AccountFilterValidator()
+		self.assertFalse(validator.validate_filter(self._row('["bad_field", "=", "x"]')).is_valid)
+		self.assertTrue(validator.validate_filter(self._row('["root_type", "=", "Income"]')).is_valid)
+
+	def test_validate_gate_still_opts_out_for_non_account_data(self):
+		# validate() is the dispatch gate: it must not validate non "Account Data" rows
+		validator = AccountFilterValidator()
+		row = self._row('["bad_field", "=", "x"]', data_source="Custom API")
+		self.assertTrue(validator.validate(row).is_valid)
+
+	def test_error_message_labels_and_escapes_field(self):
+		validator = AccountFilterValidator()
+		result = validator.validate_filter(self._row('["<script>", "=", "x"]'))
+		message = str(result.issues[0])
+		self.assertIn("[Account Filter]", message)
+		self.assertIn("&lt;script&gt;", message)
+		self.assertNotIn("<script>", message)
+
+	def test_build_conditions_raises_on_invalid_field_when_opted_in(self):
+		from erpnext.accounts.doctype.financial_report_template.financial_report_engine import (
+			FilterExpressionParser,
+		)
+
+		account = frappe.qb.DocType("Account")
+		rows = [self._row('["bad_field", "=", "x"]')]
+		parser = FilterExpressionParser()
+
+		# default: invalid rows are skipped, not raised
+		self.assertIsNone(parser.build_conditions(rows, account))
+
+		# opted in (the get_filtered_accounts path): invalid rows raise
+		self.assertRaises(
+			frappe.ValidationError, parser.build_conditions, rows, account, raise_on_invalid=True
+		)
+
+	def test_build_conditions_empty_returns_none(self):
+		from erpnext.accounts.doctype.financial_report_template.financial_report_engine import (
+			FilterExpressionParser,
+		)
+
+		account = frappe.qb.DocType("Account")
+		self.assertIsNone(FilterExpressionParser().build_conditions([], account))
+
+	def test_endpoint_requires_company(self):
+		from erpnext.accounts.doctype.financial_report_template.financial_report_engine import (
+			get_filtered_accounts,
+		)
+
+		self.assertRaises(frappe.ValidationError, get_filtered_accounts, "", "[]")
+
+	def test_endpoint_rejects_invalid_field(self):
+		from erpnext.accounts.doctype.financial_report_template.financial_report_engine import (
+			get_filtered_accounts,
+		)
+
+		company = frappe.get_all("Company", limit=1, pluck="name")[0]
+		rows = frappe.as_json([{"calculation_formula": '["bad_field", "=", "x"]'}])
+		self.assertRaises(frappe.ValidationError, get_filtered_accounts, company, rows)
+
+	def test_endpoint_empty_rows_returns_all_company_accounts(self):
+		# filters are optional: no filter returns every enabled, non-group account of the company
+		from erpnext.accounts.doctype.financial_report_template.financial_report_engine import (
+			get_filtered_accounts,
+		)
+
+		company = frappe.get_all("Company", limit=1, pluck="name")[0]
+		expected = frappe.get_all(
+			"Account",
+			filters={"company": company, "disabled": 0, "is_group": 0},
+			pluck="name",
+		)
+		self.assertEqual(sorted(get_filtered_accounts(company, "[]")), sorted(expected))

erpnext/accounts/doctype/fiscal_year/fiscal_year.json

@@ -82,7 +82,7 @@
  "icon": "fa fa-calendar",
  "idx": 1,
  "links": [],
- "modified": "2024-05-27 17:29:55.560840",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Fiscal Year",
@@ -131,6 +131,10 @@
   {
    "read": 1,
    "role": "Auditor"
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
   }
  ],
  "show_name_in_global_search": 1,

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.js

@@ -136,6 +136,7 @@ frappe.ui.form.on("Invoice Discounting", {
 			],
 			primary_action: function () {
 				var data = d.get_values();
+				data.company = frm.doc.company;
 
 				frappe.call({
 					method: "erpnext.accounts.doctype.invoice_discounting.invoice_discounting.get_invoices",

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json

@@ -1,5 +1,6 @@
 {
  "actions": [],
+ "allow_bulk_edit": 1,
  "allow_import": 1,
  "autoname": "ACC-INV-DISC-.YYYY.-.#####",
  "creation": "2019-03-07 12:01:56.296952",
@@ -170,7 +171,7 @@
  ],
  "is_submittable": 1,
  "links": [],
- "modified": "2024-03-27 13:09:52.746196",
+ "modified": "2026-09-09 17:04:59.512294",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Invoice Discounting",
@@ -187,14 +188,15 @@
    "print": 1,
    "read": 1,
    "report": 1,
-   "role": "System Manager",
+   "role": "Accounts Manager",
    "share": 1,
    "submit": 1,
    "write": 1
   }
  ],
+ "row_format": "Dynamic",
  "sort_field": "creation",
  "sort_order": "DESC",
  "states": [],
  "track_changes": 1
-}
+}

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.py

@@ -2,8 +2,6 @@
 # For license information, please see license.txt
 
 
-import json
-
 import frappe
 from frappe import _
 from frappe.utils import add_days, flt, getdate, nowdate
@@ -317,8 +315,15 @@ class InvoiceDiscounting(AccountsController):
 
 
 @frappe.whitelist()
-def get_invoices(filters):
-	filters = frappe._dict(json.loads(filters))
+def get_invoices(filters: str | dict):
+	filters = frappe._dict(frappe.parse_json(filters))
+
+	if not filters.get("company"):
+		frappe.throw(_("Please set company on the Document before requesting for invoices."))
+
+	frappe.has_permission("Company", doc=filters.get("company"), throw=True)
+	frappe.has_permission("Invoice Discounting", throw=True)
+
 	cond = []
 	if filters.customer:
 		cond.append("customer=%(customer)s")

erpnext/accounts/doctype/item_tax_template/item_tax_template.json

@@ -57,7 +57,7 @@
   }
  ],
  "links": [],
- "modified": "2024-03-27 13:09:55.573483",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Item Tax Template",
@@ -95,6 +95,54 @@
    "report": 1,
    "role": "Accounts User",
    "share": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Item Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock User",
+   "select": 1
   }
  ],
  "show_name_in_global_search": 1,

erpnext/accounts/doctype/item_tax_template/item_tax_template_dashboard.py

@@ -8,6 +8,6 @@ def get_data():
 			{"label": _("Pre Sales"), "items": ["Quotation", "Supplier Quotation"]},
 			{"label": _("Sales"), "items": ["Sales Invoice", "Sales Order", "Delivery Note"]},
 			{"label": _("Purchase"), "items": ["Purchase Invoice", "Purchase Order", "Purchase Receipt"]},
-			{"label": _("Stock"), "items": ["Item Groups", "Item"]},
+			{"label": _("Stock"), "items": ["Item Group", "Item"]},
 		],
 	}

erpnext/accounts/doctype/journal_entry/journal_entry.js

@@ -95,7 +95,7 @@ frappe.ui.form.on("Journal Entry", {
 			);
 		}
 
-		if (frm.doc.docstatus == 1) {
+		if (frm.doc.docstatus == 1 && !frm.doc.reversal_of) {
 			frm.add_custom_button(
 				__("Reverse Journal Entry"),
 				function () {
@@ -472,8 +472,8 @@ cur_frm.cscript.update_totals = function (doc) {
 		tc += flt(accounts[i].credit, precision("credit", accounts[i]));
 	}
 	doc = locals[doc.doctype][doc.name];
-	doc.total_debit = td;
-	doc.total_credit = tc;
+	doc.total_debit = flt(td, precision("total_debit"));
+	doc.total_credit = flt(tc, precision("total_credit"));
 	doc.difference = flt(td - tc, precision("difference"));
 	refresh_many(["total_debit", "total_credit", "difference"]);
 };
@@ -623,7 +623,7 @@ $.extend(erpnext.journal_entry, {
 		} else {
 			erpnext.journal_entry.set_debit_credit_in_company_currency(frm, cdt, cdn);
 		}
-		refresh_field("exchange_rate", cdn, "accounts");
+		frm.get_field("accounts").grid.refresh_row(cdn);
 	},
 
 	quick_entry: function (frm) {

erpnext/accounts/doctype/journal_entry/journal_entry.py

@@ -960,12 +960,14 @@ class JournalEntry(AccountsController):
 			if d.debit and d.credit:
 				frappe.throw(_("You cannot credit and debit same account at the same time"))
 
-			self.total_debit = flt(self.total_debit) + flt(d.debit, d.precision("debit"))
-			self.total_credit = flt(self.total_credit) + flt(d.credit, d.precision("credit"))
+			self.total_debit = flt(
+				self.total_debit + flt(d.debit, d.precision("debit")), self.precision("total_debit")
+			)
+			self.total_credit = flt(
+				self.total_credit + flt(d.credit, d.precision("credit")), self.precision("total_credit")
+			)
 
-		self.difference = flt(self.total_debit, self.precision("total_debit")) - flt(
-			self.total_credit, self.precision("total_credit")
-		)
+		self.difference = flt(self.total_debit - self.total_credit, self.precision("difference"))
 
 	def validate_multi_currency(self):
 		alternate_currency = []
@@ -1354,6 +1356,10 @@ def get_default_bank_cash_account(
 ):
 	from erpnext.accounts.doctype.sales_invoice.sales_invoice import get_bank_cash_account
 
+	# `select`, not `read`: this also runs server-side from get_payment_entry, and Auditor/HR User/Desk
+	# User hold only the select row on Company. doc= brings User Permissions to bear.
+	frappe.has_permission("Company", ptype="select", doc=company, throw=True)
+
 	if mode_of_payment:
 		account = get_bank_cash_account(mode_of_payment, company).get("account")
 
@@ -1382,6 +1388,10 @@ def get_default_bank_cash_account(
 					account = account_list[0].name
 
 	if account:
+		# `fetch_balance` is caller supplied, so authorise the account here rather than relying on
+		# get_balance_on(), which only checks on the branch that reads a balance.
+		frappe.has_permission("Account", doc=account, throw=True)
+
 		account_details = frappe.get_cached_value(
 			"Account", account, ["account_currency", "account_type"], as_dict=1
 		)
@@ -1402,6 +1412,7 @@ def get_payment_entry_against_order(
 	dt, dn, amount=None, debit_in_account_currency=None, journal_entry=False, bank_account=None
 ):
 	ref_doc = frappe.get_doc(dt, dn)
+	ref_doc.check_permission()
 
 	if flt(ref_doc.per_billed, 2) > 0:
 		frappe.throw(_("Can only make payment against unbilled {0}").format(dt))
@@ -1447,6 +1458,8 @@ def get_payment_entry_against_invoice(
 	dt, dn, amount=None, debit_in_account_currency=None, journal_entry=False, bank_account=None
 ):
 	ref_doc = frappe.get_doc(dt, dn)
+	ref_doc.check_permission()
+
 	if dt == "Sales Invoice":
 		party_type = "Customer"
 		party_account = get_party_account_based_on_invoice_discounting(dn) or ref_doc.debit_to
@@ -1482,6 +1495,8 @@ def get_payment_entry_against_invoice(
 
 
 def get_payment_entry(ref_doc, args):
+	frappe.has_permission("Journal Entry", ptype="create", throw=True)
+
 	cost_center = ref_doc.get("cost_center") or frappe.get_cached_value(
 		"Company", ref_doc.company, "cost_center"
 	)
@@ -1561,30 +1576,39 @@ def get_against_jv(doctype, txt, searchfield, start, page_len, filters):
 	if not frappe.db.has_column("Journal Entry", searchfield):
 		return []
 
-	JournalEntry = frappe.qb.DocType("Journal Entry")
-	JournalEntryAccount = frappe.qb.DocType("Journal Entry Account")
+	account = filters.get("account")
+	party = filters.get("party")
 
-	query = (
-		frappe.qb.from_(JournalEntry)
-		.join(JournalEntryAccount)
-		.on(JournalEntryAccount.parent == JournalEntry.name)
-		.select(JournalEntry.name, JournalEntry.posting_date, JournalEntry.remark)
-		.where(JournalEntryAccount.account == filters.get("account"))
-		.where(JournalEntryAccount.reference_type.isnull() | (JournalEntryAccount.reference_type == ""))
-		.where(JournalEntry.docstatus == 1)
-		.where(JournalEntry[searchfield].like(f"%{txt}%"))
-		.orderby(JournalEntry.name, order=frappe.qb.desc)
-		.limit(page_len)
-		.offset(start)
+	# each names one value: a list would be read as a filter operator and widen the search.
+	for value in (account, party):
+		if value and not isinstance(value, str):
+			frappe.throw(_("Invalid filter"), frappe.PermissionError)
+
+	# get_list applies the permission query conditions; the child-table filter resolves the check to `read`
+	je_filters = [
+		["docstatus", "=", 1],
+		[searchfield, "like", f"%{txt}%"],
+		["Journal Entry Account", "account", "=", account],
+		["Journal Entry Account", "reference_type", "is", "not set"],
+	]
+	je_filters.append(
+		["Journal Entry Account", "party", "=", party]
+		if party
+		else ["Journal Entry Account", "party", "is", "not set"]
 	)
 
-	party = filters.get("party")
-	if party:
-		query = query.where(JournalEntryAccount.party == party)
-	else:
-		query = query.where(JournalEntryAccount.party.isnull() | (JournalEntryAccount.party == ""))
-
-	return query.run()
+	return frappe.get_list(
+		"Journal Entry",
+		filters=je_filters,
+		fields=["name", "posting_date", "remark"],
+		order_by="name desc",
+		limit_start=start,
+		limit_page_length=page_len,
+		as_list=True,
+		# one row per entry, not per matching account row. group_by rather than distinct: frappe
+		# drops ORDER BY from a distinct query on postgres, which would lose the ordering above.
+		group_by="name",
+	)
 
 
 @frappe.whitelist()
@@ -1777,6 +1801,20 @@ def make_inter_company_journal_entry(name, voucher_type, company):
 
 @frappe.whitelist()
 def make_reverse_journal_entry(source_name, target_doc=None):
+	# `get_mapped_doc` checks this as well, but the guards below disclose which entry
+	# reverses which, so read access has to be settled before they run
+	if not frappe.has_permission("Journal Entry", doc=source_name):
+		frappe.throw(_("Not permitted"), frappe.PermissionError)
+
+	reversal_of = frappe.db.get_value("Journal Entry", source_name, "reversal_of")
+	if reversal_of:
+		frappe.throw(
+			_("{0} is already a Reverse Journal Entry of {1}. Cancel it instead of reversing it.").format(
+				get_link_to_form("Journal Entry", source_name),
+				get_link_to_form("Journal Entry", reversal_of),
+			)
+		)
+
 	existing_reverse = frappe.db.exists("Journal Entry", {"reversal_of": source_name, "docstatus": 1})
 	if existing_reverse:
 		frappe.throw(
@@ -1789,6 +1827,10 @@ def make_reverse_journal_entry(source_name, target_doc=None):
 
 	def post_process(source, target):
 		target.reversal_of = source.name
+		target.naming_series = source.naming_series
+		if source.voucher_type == "Bank Entry":
+			target.cheque_no = source.cheque_no
+			target.cheque_date = source.cheque_date
 
 	doclist = get_mapped_doc(
 		"Journal Entry",

erpnext/accounts/doctype/journal_entry/test_journal_entry.py

@@ -248,6 +248,27 @@ class TestJournalEntry(ERPNextTestSuite):
 
 		self.check_gl_entries()
 
+	def test_disallow_reversal_of_a_reversal_journal_entry(self):
+		from erpnext.accounts.doctype.journal_entry.journal_entry import make_reverse_journal_entry
+
+		jv = make_journal_entry("_Test Bank - _TC", "Sales - _TC", 100, submit=True)
+
+		rjv = make_reverse_journal_entry(jv.name)
+		rjv.posting_date = nowdate()
+		rjv.submit()
+
+		self.assertRaisesRegex(
+			frappe.ValidationError,
+			"is already a Reverse Journal Entry",
+			make_reverse_journal_entry,
+			rjv.name,
+		)
+
+		# the guard must not disclose the reversal to a user who cannot read the entry
+		frappe.set_user("Guest")
+		self.addCleanup(frappe.set_user, "Administrator")
+		self.assertRaises(frappe.PermissionError, make_reverse_journal_entry, rjv.name)
+
 	def test_disallow_change_in_account_currency_for_a_party(self):
 		# create jv in USD
 		jv = make_journal_entry("_Test Bank USD - _TC", "_Test Receivable USD - _TC", 100, save=False)
@@ -388,6 +409,59 @@ class TestJournalEntry(ERPNextTestSuite):
 
 		self.check_gl_entries()
 
+	def make_jv_with_fractional_totals(self):
+		"""0.10 + 0.20 sums to 0.30000000000000004, the residue this guards against."""
+		jv = frappe.new_doc("Journal Entry")
+		jv.posting_date = nowdate()
+		jv.company = "_Test Company"
+		jv.voucher_type = "Journal Entry"
+		jv.remark = "test"
+		for amount in (0.10, 0.20):
+			jv.append(
+				"accounts",
+				{
+					"account": "_Test Cash - _TC",
+					"cost_center": "_Test Cost Center - _TC",
+					"debit_in_account_currency": amount,
+				},
+			)
+		jv.append(
+			"accounts",
+			{
+				"account": "_Test Bank - _TC",
+				"cost_center": "_Test Cost Center - _TC",
+				"credit_in_account_currency": 0.30,
+			},
+		)
+		jv.insert()
+		return jv
+
+	def test_totals_are_rounded_to_precision(self):
+		jv = self.make_jv_with_fractional_totals()
+		jv.submit()
+
+		stored = frappe.db.get_value(
+			"Journal Entry", jv.name, ["total_debit", "total_credit", "difference"], as_dict=True
+		)
+		self.assertEqual(jv.total_debit, flt(jv.total_debit, jv.precision("total_debit")))
+		self.assertEqual(jv.total_credit, flt(jv.total_credit, jv.precision("total_credit")))
+		self.assertEqual(jv.total_debit, stored.total_debit)
+		self.assertEqual(jv.total_credit, stored.total_credit)
+		self.assertEqual(jv.difference, stored.difference)
+
+	def test_update_after_submit_with_fractional_totals(self):
+		"""An unrounded total is stored rounded, so updating a submitted entry used to throw."""
+		jv = self.make_jv_with_fractional_totals()
+		jv.submit()
+
+		jv.pay_to_recd_from = "_Test Supplier"
+		jv.save()
+
+		self.assertEqual(jv.docstatus, 1)
+		self.assertEqual(
+			jv.pay_to_recd_from, frappe.db.get_value("Journal Entry", jv.name, "pay_to_recd_from")
+		)
+
 	def test_jv_account_and_party_balance_with_cost_centre(self):
 		from erpnext.accounts.doctype.cost_center.test_cost_center import create_cost_center
 		from erpnext.accounts.utils import get_balance_on

erpnext/accounts/doctype/ledger_merge/ledger_merge.py

@@ -56,7 +56,9 @@ class LedgerMerge(Document):
 
 @frappe.whitelist()
 def form_start_merge(docname):
-	return frappe.get_doc("Ledger Merge", docname).start_merge()
+	lm_doc = frappe.get_doc("Ledger Merge", docname)
+	lm_doc.check_permission("write")
+	return lm_doc.start_merge()
 
 
 def start_merge(docname):

erpnext/accounts/doctype/loyalty_program/loyalty_program.json

@@ -154,7 +154,7 @@
   }
  ],
  "links": [],
- "modified": "2024-03-27 13:10:03.361383",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Loyalty Program",
@@ -171,6 +171,14 @@
    "role": "System Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/loyalty_program/loyalty_program.py

@@ -96,6 +96,8 @@ def get_loyalty_program_details_with_points(
 	include_expired_entry=False,
 	current_transaction_amount=0,
 ):
+	frappe.has_permission("Customer", doc=customer, throw=True)
+
 	lp_details = get_loyalty_program_details(customer, loyalty_program, company=company, silent=silent)
 	loyalty_program = frappe.get_doc("Loyalty Program", loyalty_program)
 	loyalty_details = get_loyalty_details(
@@ -126,6 +128,10 @@ def get_loyalty_program_details(
 	silent=False,
 	include_expired_entry=False,
 ):
+	# The customer is what the caller is entitled to, not the programme: a check on Loyalty Program
+	# would be read-only to System Manager and deny every role that fills in the calling forms.
+	frappe.has_permission("Customer", doc=customer, throw=True)
+
 	lp_details = frappe._dict()
 
 	if not loyalty_program:
@@ -147,6 +153,13 @@ def get_loyalty_program_details(
 
 @frappe.whitelist()
 def get_redeemption_factor(loyalty_program=None, customer=None):
+	# both call sites send only `loyalty_program`, so the calling form is the boundary; the customer branch stays guarded
+	if not (frappe.has_permission("Sales Invoice") or frappe.has_permission("POS Invoice")):
+		frappe.throw(_("Not permitted"), frappe.PermissionError)
+
+	if customer:
+		frappe.has_permission("Customer", doc=customer, throw=True)
+
 	customer_loyalty_program = None
 	if not loyalty_program:
 		customer_loyalty_program = frappe.db.get_value("Customer", customer, "loyalty_program")

erpnext/accounts/doctype/mode_of_payment/mode_of_payment.json

@@ -48,7 +48,7 @@
  "idx": 1,
  "index_web_pages_for_search": 1,
  "links": [],
- "modified": "2026-04-14 18:16:47.795986",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Mode of Payment",
@@ -76,6 +76,30 @@
   {
    "role": "HR Manager",
    "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/monthly_distribution/monthly_distribution.json

@@ -46,7 +46,7 @@
  "icon": "fa fa-bar-chart",
  "idx": 1,
  "links": [],
- "modified": "2024-03-27 13:10:05.873547",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Monthly Distribution",
@@ -69,6 +69,10 @@
    "read": 1,
    "report": 1,
    "role": "Accounts Manager"
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
   }
  ],
  "sort_field": "creation",

erpnext/accounts/doctype/opening_invoice_creation_tool/opening_invoice_creation_tool.py

@@ -297,6 +297,9 @@ def start_import(invoices):
 				invoice_number = d.invoice_number
 			doc = frappe.get_doc(d)
 			doc.flags.ignore_mandatory = True
+			# the outstanding amount is entered inclusive of tax, so taxes must not
+			# be added on top of it
+			doc.flags.dont_auto_add_taxes = True
 			doc.insert(set_name=invoice_number)
 			doc.submit()
 			if not frappe.in_test:

erpnext/accounts/doctype/opening_invoice_creation_tool/test_opening_invoice_creation_tool.py

@@ -4,9 +4,11 @@
 import frappe
 from frappe.utils import add_days, today
 
+from erpnext.accounts.doctype.account.test_account import create_account
 from erpnext.accounts.doctype.opening_invoice_creation_tool.opening_invoice_creation_tool import (
 	get_temporary_opening_account,
 )
+from erpnext.accounts.doctype.tax_rule.test_tax_rule import make_tax_rule
 from erpnext.projects.doctype.project.test_project import make_project
 from erpnext.tests.utils import ERPNextTestSuite
 
@@ -126,6 +128,55 @@ class TestOpeningInvoiceCreationTool(ERPNextTestSuite):
 		for invoice in invoices:
 			self.assertEqual(frappe.db.get_value("Sales Invoice", invoice, "department"), "Sales - _TOIC")
 
+	@ERPNextTestSuite.change_settings(
+		"Accounts Settings",
+		{"add_taxes_from_taxes_and_charges_template": 1, "add_taxes_from_item_tax_template": 0},
+	)
+	def test_opening_invoice_creation_without_taxes(self):
+		company = "_Test Opening Invoice Company"
+		template = frappe.get_doc(
+			{
+				"doctype": "Sales Taxes and Charges Template",
+				"company": company,
+				"title": "_Test Opening Invoice Tax",
+				"taxes": [
+					{
+						"charge_type": "On Net Total",
+						"account_head": create_account(
+							account_name="_Test Opening Tax Account",
+							parent_account="Duties and Taxes - _TOIC",
+							account_type="Tax",
+							company=company,
+						),
+						"description": "Test taxes",
+						"rate": 9,
+					}
+				],
+			}
+		).insert()
+
+		# makes the template the default for the party, as it would be on a live site
+		make_tax_rule(tax_type="Sales", company=company, sales_tax_template=template.name, save=1)
+
+		tool = self.make_invoices(company=company, return_doc=True)
+		invoices = tool.make_invoices()
+		self.assertEqual(len(invoices), 2)
+
+		# outstanding amount is entered inclusive of tax, so taxes must not be added on top of it
+		for invoice in invoices:
+			si = frappe.get_doc("Sales Invoice", invoice)
+			self.assertFalse(si.taxes)
+			self.assertEqual(si.grand_total, 200)
+			self.assertEqual(si.outstanding_amount, 200)
+
+		# the same invoice created outside the tool keeps the default taxes,
+		# since adding them there is the user's decision
+		si = frappe.get_doc(tool.get_invoices()[0])
+		si.flags.ignore_mandatory = True
+		si.insert()
+		self.assertTrue(si.taxes)
+		self.assertEqual(si.grand_total, 218)
+
 	def test_opening_entry_project_linking(self):
 		doc = self.make_invoices(
 			company="_Test Opening Invoice Company", invoice_type="Sales", return_doc=True

erpnext/accounts/doctype/payment_entry/payment_entry.js

@@ -46,23 +46,27 @@ frappe.ui.form.on("Payment Entry", {
 	},
 
 	setup: function (frm) {
-		frm.set_query("paid_from", function () {
+		frm.set_query("paid_from", function (doc) {
 			frm.events.validate_company(frm);
 
 			var account_types = ["Pay", "Internal Transfer"].includes(frm.doc.payment_type)
 				? ["Bank", "Cash"]
 				: [frappe.boot.party_account_types[frm.doc.party_type]];
+			let filters = {
+				account_type: ["in", account_types],
+				is_group: 0,
+				company: doc.company,
+			};
 
 			if (frm.doc.party_type == "Shareholder") {
 				account_types.push("Equity");
 			}
+			if (doc.payment_type == "Internal Transfer" && doc.paid_to) {
+				filters.name = ["!=", doc.paid_to];
+			}
 
 			return {
-				filters: {
-					account_type: ["in", account_types],
-					is_group: 0,
-					company: frm.doc.company,
-				},
+				filters,
 			};
 		});
 
@@ -106,21 +110,25 @@ frappe.ui.form.on("Payment Entry", {
 			}
 		});
 
-		frm.set_query("paid_to", function () {
+		frm.set_query("paid_to", function (doc) {
 			frm.events.validate_company(frm);
 
 			var account_types = ["Receive", "Internal Transfer"].includes(frm.doc.payment_type)
 				? ["Bank", "Cash"]
 				: [frappe.boot.party_account_types[frm.doc.party_type]];
+			let filters = {
+				account_type: ["in", account_types],
+				is_group: 0,
+				company: doc.company,
+			};
 			if (frm.doc.party_type == "Shareholder") {
 				account_types.push("Equity");
 			}
+			if (doc.payment_type == "Internal Transfer" && doc.paid_from) {
+				filters.name = ["!=", doc.paid_from];
+			}
 			return {
-				filters: {
-					account_type: ["in", account_types],
-					is_group: 0,
-					company: frm.doc.company,
-				},
+				filters,
 			};
 		});
 

erpnext/accounts/doctype/payment_entry/payment_entry.py

@@ -3,6 +3,7 @@
 
 
 import json
+from datetime import date
 from functools import reduce
 
 import frappe
@@ -175,6 +176,7 @@ class PaymentEntry(AccountsController):
 		self.set_liability_account()
 		self.set_missing_ref_details(force=True)
 		self.validate_payment_type()
+		self.validate_internal_transfer_accounts()
 		self.validate_party_details()
 		self.set_exchange_rate()
 		self.validate_mandatory()
@@ -207,9 +209,15 @@ class PaymentEntry(AccountsController):
 		self.update_payment_schedule()
 		self.make_gl_entries()
 		self.update_outstanding_amounts()
+		self.update_linked_dunnings()
 		self.set_status()
 		self.trigger_invoice_update_for_subscriptions()
 
+	def update_linked_dunnings(self):
+		from erpnext.accounts.doctype.dunning.dunning import update_dunnings_linked_to_payment
+
+		update_dunnings_linked_to_payment(self)
+
 	def validate_for_repost(self):
 		validate_docs_for_voucher_types(["Payment Entry"])
 		validate_docs_for_deferred_accounting([self.name], [])
@@ -313,6 +321,7 @@ class PaymentEntry(AccountsController):
 		self.update_payment_schedule(cancel=1)
 		self.make_gl_entries(cancel=1)
 		self.update_outstanding_amounts()
+		self.update_linked_dunnings()
 		self.delink_advance_entry_references()
 		self.set_status()
 		self.trigger_invoice_update_for_subscriptions()
@@ -623,6 +632,10 @@ class PaymentEntry(AccountsController):
 		if self.payment_type not in ("Receive", "Pay", "Internal Transfer"):
 			frappe.throw(_("Payment Type must be one of Receive, Pay and Internal Transfer"))
 
+	def validate_internal_transfer_accounts(self):
+		if self.payment_type == "Internal Transfer" and self.paid_from and self.paid_from == self.paid_to:
+			frappe.throw(_("Paid From and Paid To accounts must be different for an Internal Transfer."))
+
 	def validate_party_details(self):
 		if self.party and not frappe.db.exists(self.party_type, self.party):
 			frappe.throw(_("{0} {1} does not exist").format(_(self.party_type), self.party))
@@ -2883,17 +2896,21 @@ def get_reference_details(
 
 @frappe.whitelist()
 def get_payment_entry(
-	dt,
-	dn,
-	party_amount=None,
-	bank_account=None,
-	bank_amount=None,
-	party_type=None,
-	payment_type=None,
-	reference_date=None,
-	created_from_payment_request=False,
+	dt: str,
+	dn: str,
+	party_amount: int | float | None = None,
+	bank_account: str | None = None,
+	bank_amount: int | float | None = None,
+	party_type: str | None = None,
+	payment_type: str | None = None,
+	reference_date: str | date | None = None,
+	created_from_payment_request: bool | None = False,
 ):
+	frappe.has_permission("Payment Entry", ptype="create", throw=True)
+
 	doc = frappe.get_doc(dt, dn)
+	doc.check_permission()
+
 	over_billing_allowance = frappe.get_single_value("Accounts Settings", "over_billing_allowance")
 	if dt in ("Sales Order", "Purchase Order") and flt(doc.per_billed, 2) >= (100.0 + over_billing_allowance):
 		frappe.throw(_("Can only make payment against unbilled {0}").format(_(dt)))
@@ -2988,7 +3005,7 @@ def get_payment_entry(
 				pe.append("references", reference)
 		else:
 			if dt == "Dunning":
-				for overdue_payment in doc.overdue_payments:
+				for overdue_payment, outstanding in doc.get_unpaid_overdue_payments():
 					pe.append(
 						"references",
 						{
@@ -2996,21 +3013,23 @@ def get_payment_entry(
 							"reference_name": overdue_payment.sales_invoice,
 							"payment_term": overdue_payment.payment_term,
 							"due_date": overdue_payment.due_date,
-							"total_amount": overdue_payment.outstanding,
-							"outstanding_amount": overdue_payment.outstanding,
-							"allocated_amount": overdue_payment.outstanding,
+							"total_amount": outstanding,
+							"outstanding_amount": outstanding,
+							"allocated_amount": outstanding,
 						},
 					)
 
-				pe.append(
-					"deductions",
-					{
-						"account": doc.income_account,
-						"cost_center": doc.cost_center,
-						"amount": -1 * doc.dunning_amount,
-						"description": _("Interest and/or dunning fee"),
-					},
-				)
+				if (unpaid_dunning_amount := doc.get_unpaid_base_dunning_amount()) > 0:
+					pe.append(
+						"deductions",
+						{
+							"account": doc.income_account,
+							"cost_center": doc.cost_center,
+							"amount": -1 * unpaid_dunning_amount,
+							"description": _("Interest and/or dunning fee"),
+							"dunning": doc.name,
+						},
+					)
 			else:
 				pe.append(
 					"references",
@@ -3300,8 +3319,10 @@ def set_grand_total_and_outstanding_amount(party_amount, dt, party_account_curre
 			grand_total = doc.rounded_total or doc.grand_total
 		outstanding_amount = doc.outstanding_amount
 	elif dt == "Dunning":
-		grand_total = doc.grand_total
-		outstanding_amount = doc.grand_total
+		# only what is left to collect, the totals on the dunning are the ones it was raised with
+		grand_total = sum(outstanding for _row, outstanding in doc.get_unpaid_overdue_payments())
+		grand_total += doc.get_unpaid_dunning_amount()
+		outstanding_amount = grand_total
 	else:
 		if party_account_currency == doc.company_currency:
 			grand_total = flt(doc.get("base_rounded_total") or doc.get("base_grand_total"))

erpnext/accounts/doctype/payment_entry/test_payment_entry.py

@@ -726,6 +726,23 @@ class TestPaymentEntry(ERPNextTestSuite):
 
 		self.validate_gl_entries(pe.name, expected_gle)
 
+	def test_internal_transfer_rejects_same_account(self):
+		pe = frappe.new_doc("Payment Entry")
+		pe.payment_type = "Internal Transfer"
+		pe.company = "_Test Company"
+		pe.paid_from = "_Test Bank - _TC"
+		pe.paid_to = "_Test Bank - _TC"
+		pe.paid_amount = 100
+		pe.received_amount = 100
+		pe.reference_no = "same-account-transfer"
+		pe.reference_date = nowdate()
+
+		self.assertRaisesRegex(
+			frappe.ValidationError,
+			"Paid From and Paid To accounts must be different",
+			pe.insert,
+		)
+
 	def test_payment_against_negative_sales_invoice(self):
 		si1 = create_sales_invoice()
 

erpnext/accounts/doctype/payment_entry_deduction/payment_entry_deduction.json

@@ -10,7 +10,8 @@
   "amount",
   "column_break_2",
   "is_exchange_gain_loss",
-  "description"
+  "description",
+  "dunning"
  ],
  "fields": [
   {
@@ -55,12 +56,21 @@
    "fieldtype": "Check",
    "label": "Is Exchange Gain / Loss?",
    "read_only": 1
+  },
+  {
+   "fieldname": "dunning",
+   "fieldtype": "Link",
+   "label": "Dunning",
+   "no_copy": 1,
+   "options": "Dunning",
+   "print_hide": 1,
+   "read_only": 1
   }
  ],
  "index_web_pages_for_search": 1,
  "istable": 1,
  "links": [],
- "modified": "2026-03-11 14:26:11.312950",
+ "modified": "2026-08-17 11:20:35.482913",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Payment Entry Deduction",

erpnext/accounts/doctype/payment_entry_deduction/payment_entry_deduction.py

@@ -18,6 +18,7 @@ class PaymentEntryDeduction(Document):
 		amount: DF.Currency
 		cost_center: DF.Link
 		description: DF.SmallText | None
+		dunning: DF.Link | None
 		is_exchange_gain_loss: DF.Check
 		parent: DF.Data
 		parentfield: DF.Data

erpnext/accounts/doctype/payment_order/payment_order.py

@@ -57,32 +57,63 @@ class PaymentOrder(Document):
 			frappe.db.set_value(self.payment_order_type, d.get(ref_doc_field), ref_field, status)
 
 
+def _readable_payment_order(filters):
+	"""Authorise the parent before reading its rows.
+
+	A child table carries no permissions of its own, so a read of it has to be authorised on the
+	Payment Order the rows belong to.
+	"""
+	parent = filters.get("parent")
+	if not parent or not frappe.db.exists("Payment Order", parent):
+		return None
+
+	ptype = "select" if frappe.only_has_select_perm("Payment Order") else "read"
+	frappe.has_permission("Payment Order", ptype, doc=parent, throw=True)
+	return parent
+
+
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_mop_query(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		""" select mode_of_payment from `tabPayment Order Reference`
-		where parent = %(parent)s and mode_of_payment like %(txt)s
-		limit %(page_len)s offset %(start)s""",
-		{"parent": filters.get("parent"), "start": start, "page_len": page_len, "txt": "%%%s%%" % txt},
+	if not _readable_payment_order(filters):
+		return []
+
+	return frappe.get_all(
+		"Payment Order Reference",
+		filters={"parent": filters.get("parent"), "mode_of_payment": ["like", f"%{txt}%"]},
+		fields=["mode_of_payment"],
+		limit_start=start,
+		limit_page_length=page_len,
+		order_by="",  # match the original query (no ORDER BY); avoid get_all's default sort
+		as_list=True,
 	)
 
 
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_supplier_query(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		""" select supplier from `tabPayment Order Reference`
-		where parent = %(parent)s and supplier like %(txt)s and
-		(payment_reference is null or payment_reference='')
-		limit %(page_len)s offset %(start)s""",
-		{"parent": filters.get("parent"), "start": start, "page_len": page_len, "txt": "%%%s%%" % txt},
+	if not _readable_payment_order(filters):
+		return []
+
+	return frappe.get_all(
+		"Payment Order Reference",
+		filters={
+			"parent": filters.get("parent"),
+			"supplier": ["like", f"%{txt}%"],
+			"payment_reference": ["is", "not set"],
+		},
+		fields=["supplier"],
+		limit_start=start,
+		limit_page_length=page_len,
+		order_by="",  # match the original query (no ORDER BY); avoid get_all's default sort
+		as_list=True,
 	)
 
 
 @frappe.whitelist()
 def make_payment_records(name, supplier, mode_of_payment=None):
 	doc = frappe.get_doc("Payment Order", name)
+	doc.check_permission()
 	make_journal_entry(doc, supplier, mode_of_payment)
 
 

erpnext/accounts/doctype/payment_request/payment_request.js

@@ -92,6 +92,7 @@ frappe.ui.form.on("Payment Request", "is_a_subscription", function (frm) {
 			freeze: true,
 			callback: function (data) {
 				if (!data.exc) {
+					frm.clear_table("subscription_plans");
 					$.each(data.message || [], function (i, v) {
 						var d = frappe.model.add_child(
 							frm.doc,

erpnext/accounts/doctype/payment_request/payment_request.py

@@ -711,6 +711,7 @@ def make_payment_request(**args):
 			party_account = get_party_account(party_type, ref_doc.get(party_type.lower()), ref_doc.company)
 			party_account_currency = get_account_currency(party_account)
 
+		subscription_plans = get_subscription_details(ref_doc.doctype, ref_doc.name)
 		pr.update(
 			{
 				"payment_gateway_account": gateway_account.get("name"),
@@ -742,12 +743,24 @@ def make_payment_request(**args):
 					or gateway_account.get("payment_channel", "Email") != "Email"
 				),
 				"phone_number": args.get("phone_number") if args.get("phone_number") else None,
+				"is_a_subscription": 1 if subscription_plans else 0,
 			}
 		)
 
 		if selected_payment_schedules:
 			apply_payment_references(pr, payment_reference)
 
+		if subscription_plans:
+			pr.set(
+				"subscription_plans",
+				[
+					{
+						"plan": row.plan,
+						"qty": row.qty,
+					}
+					for row in subscription_plans
+				],
+			)
 		# Dimensions
 		pr.update(
 			{
@@ -1061,19 +1074,25 @@ def get_dummy_message(doc):
 
 
 @frappe.whitelist()
-def get_subscription_details(reference_doctype, reference_name):
-	if reference_doctype == "Sales Invoice":
-		subscriptions = frappe.db.sql(
-			"""SELECT parent as sub_name FROM `tabSubscription Invoice` WHERE invoice=%s""",
-			reference_name,
-			as_dict=1,
-		)
-		subscription_plans = []
-		for subscription in subscriptions:
-			plans = frappe.get_doc("Subscription", subscription.sub_name).plans
-			for plan in plans:
-				subscription_plans.append(plan)
-		return subscription_plans
+def get_subscription_details(reference_doctype: str, reference_name: str) -> list[dict]:
+	frappe.has_permission(reference_doctype, "read", reference_name, throw=True)
+
+	if not frappe.get_meta(reference_doctype).has_field("subscription"):
+		return []
+
+	subscription = frappe.db.get_value(reference_doctype, reference_name, "subscription")
+
+	if not subscription:
+		return []
+
+	return frappe.get_all(
+		"Subscription Plan Detail",
+		filters={"parent": subscription, "parenttype": "Subscription", "parentfield": "plans"},
+		fields=[
+			"plan",
+			"qty",
+		],
+	)
 
 
 @frappe.whitelist()
@@ -1169,6 +1188,7 @@ def get_irequests_of_payment_request(doc: str | None = None) -> list:
 @frappe.whitelist()
 def get_available_payment_schedules(reference_doctype, reference_name):
 	ref_doc = frappe.get_doc(reference_doctype, reference_name)
+	ref_doc.check_permission()
 
 	if not hasattr(ref_doc, "payment_schedule") or not ref_doc.payment_schedule:
 		return []

erpnext/accounts/doctype/payment_term/payment_term.json

@@ -116,7 +116,7 @@
   }
  ],
  "links": [],
- "modified": "2024-03-27 13:10:11.511137",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Payment Term",
@@ -157,6 +157,30 @@
    "role": "Accounts User",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py

@@ -254,6 +254,13 @@ class POSClosingEntry(StatusUpdater):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_cashiers(doctype, txt, searchfield, start, page_len, filters):
+	pos_profile = filters.get("parent")
+	if not pos_profile or not frappe.db.exists("POS Profile", pos_profile):
+		return []
+
+	ptype = "select" if frappe.only_has_select_perm("POS Profile") else "read"
+	frappe.has_permission("POS Profile", ptype, doc=pos_profile, throw=True)
+
 	cashiers_list = frappe.get_all("POS Profile User", filters=filters, fields=["user"], as_list=1)
 	return [c for c in cashiers_list]
 
@@ -261,12 +268,15 @@ def get_cashiers(doctype, txt, searchfield, start, page_len, filters):
 @frappe.whitelist()
 def get_invoices(start, end, pos_profile, user):
 	invoice_doctype = frappe.db.get_single_value("POS Settings", "invoice_type")
+	frappe.has_permission("POS Profile", doc=pos_profile, throw=True)
 
+	frappe.has_permission("Sales Invoice", throw=True)
 	sales_inv_query = build_invoice_query("Sales Invoice", user, pos_profile, start, end)
 
 	query = sales_inv_query
 
 	if invoice_doctype == "POS Invoice":
+		frappe.has_permission("POS Invoice", throw=True)
 		pos_inv_query = build_invoice_query("POS Invoice", user, pos_profile, start, end)
 		query = query + pos_inv_query
 

erpnext/accounts/doctype/pos_invoice/pos_invoice.json

@@ -497,6 +497,7 @@
   },
   {
    "collapsible": 1,
+   "collapsible_depends_on": "eval:doc.currency && doc.currency != erpnext.get_currency(doc.company)",
    "depends_on": "customer",
    "fieldname": "currency_and_price_list",
    "fieldtype": "Section Break",
@@ -1636,7 +1637,7 @@
  "icon": "fa fa-file-text",
  "is_submittable": 1,
  "links": [],
- "modified": "2026-05-28 12:22:50.253090",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "POS Invoice",
@@ -1679,6 +1680,14 @@
    "permlevel": 1,
    "read": 1,
    "role": "All"
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",