fix: type hints for get_children and enqueue opening stock after commit (semgrep)

fix(UX): Work order UX cleanup

(cherry picked from commit f45b22b79c)

.github/workflows/linters.yml

@@ -23,6 +23,19 @@ jobs:
       - name: Install and Run Pre-commit
         uses: pre-commit/action@v3.0.1
 
+  js-unit-tests:
+    name: js unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Run JS unit tests
+        run: yarn test:js
+
   semgrep:
     name: semgrep
     runs-on: ubuntu-latest

erpnext/accounts/custom/address.py

@@ -55,6 +55,9 @@ class ERPNextAddress(Address):
 
 @frappe.whitelist()
 def get_shipping_address(company, address=None):
+	# `select`, not `read`: Delivery, Maintenance, Purchase and Stock Manager fill in forms that ask
+	# for this while holding no Company `read` row. doc= so User Permissions apply to the named company.
+	frappe.has_permission("Company", ptype="select", doc=company, throw=True)
 	filters = [
 		["Dynamic Link", "link_doctype", "=", "Company"],
 		["Dynamic Link", "link_name", "=", company],

erpnext/accounts/dashboard_chart_source/account_balance_timeline/account_balance_timeline.py

@@ -24,7 +24,7 @@ def get(
 	heatmap_year=None,
 ):
 	if chart_name:
-		chart = frappe.get_doc("Dashboard Chart", chart_name)
+		chart = frappe.get_doc("Dashboard Chart", chart_name, check_permission="read")
 	else:
 		chart = frappe._dict(frappe.parse_json(chart))
 	timespan = chart.timespan
@@ -53,6 +53,9 @@ def get(
 			)
 		)
 
+	# authorise the account itself, as get_balance_on() does; doc= brings User Permissions with it
+	frappe.has_permission("Account", doc=account, throw=True)
+
 	if not to_date:
 		to_date = nowdate()
 	if not from_date:

erpnext/accounts/doctype/account/account.json

@@ -7,6 +7,7 @@
  "description": "Heads (or groups) against which Accounting Entries are made and balances are maintained.",
  "doctype": "DocType",
  "document_type": "Setup",
+ "documentation": "https://docs.frappe.io/erpnext/chart-of-accounts",
  "engine": "InnoDB",
  "field_order": [
   "properties",
@@ -122,6 +123,7 @@
    "description": "Setting Account Type helps in selecting this Account in transactions.",
    "fieldname": "account_type",
    "fieldtype": "Select",
+   "in_preview": 1,
    "in_standard_filter": 1,
    "label": "Account Type",
    "oldfieldname": "account_type",
@@ -199,11 +201,11 @@
    "options": "Account Category"
   }
  ],
- "icon": "fa fa-money",
+ "icon": "vault",
  "idx": 1,
  "is_tree": 1,
  "links": [],
- "modified": "2026-04-14 18:14:42.202065",
+ "modified": "2026-09-25 15:33:56.058228",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Account",
@@ -264,6 +266,46 @@
   {
    "role": "HR Manager",
    "select": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/account/account.py

@@ -503,12 +503,19 @@ class Account(NestedSet):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_parent_account(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		"""select name from tabAccount
-		where is_group = 1 and docstatus != 2 and company = {}
-		and {} like {} order by name limit {} offset {}""".format("%s", searchfield, "%s", "%s", "%s"),
-		(filters["company"], "%%%s%%" % txt, page_len, start),
-		as_list=1,
+	return frappe.get_list(
+		"Account",
+		filters=[
+			["is_group", "=", 1],
+			["docstatus", "!=", 2],
+			["company", "=", filters["company"]],
+			[searchfield, "like", f"%{txt}%"],
+		],
+		fields=["name"],
+		order_by="name",
+		limit_start=start,
+		limit_page_length=page_len,
+		as_list=True,
 	)
 
 

erpnext/accounts/doctype/account/account_tree.js

@@ -52,6 +52,42 @@ frappe.treeview_settings["Account"] = {
 	],
 	root_label: "Accounts",
 	get_tree_nodes: "erpnext.accounts.utils.get_children",
+	get_label: function (node) {
+		// clean display name — the account number renders as a badge (see
+		// onrender) instead of being glued into the name
+		return frappe.utils.escape_html(node.data.account_name || node.title || node.label);
+	},
+	onrender: function (node) {
+		if (node.is_root || !node.data) return;
+
+		const flags = [];
+		if (node.data.account_number) {
+			flags.push(frappe.ui.badge({ label: node.data.account_number }));
+		}
+
+		const company = frappe.treeview_settings["Account"].treeview?.page?.fields_dict?.company?.get_value();
+		const company_currency = company && erpnext.get_currency(company);
+		if (
+			node.data.account_currency &&
+			company_currency &&
+			node.data.account_currency !== company_currency
+		) {
+			flags.push(frappe.ui.badge({ label: node.data.account_currency, theme: "blue" }));
+		}
+
+		if (node.data.freeze_account === "Yes") {
+			flags.push(
+				frappe.ui.badge({
+					label: __("Frozen"),
+					icon: "lock",
+					title: __("Frozen - entries restricted"),
+					theme: "orange",
+				})
+			);
+		}
+
+		erpnext.utils.render_tree_node_flags(node, flags);
+	},
 	on_node_render: function (node, deep) {
 		const render_balances = () => {
 			for (let account of cur_tree.account_balance_data) {
@@ -232,7 +268,7 @@ frappe.treeview_settings["Account"] = {
 		frappe.treeview_settings["Account"].treeview["tree"] = treeview.tree;
 		if (treeview.can_create) {
 			treeview.page.set_primary_action(
-				__("New"),
+				{ label: __("Add Account"), short_label: __("Add") },
 				function () {
 					let root_company = treeview.page.fields_dict.root_company.get_value();
 					if (root_company) {
@@ -243,13 +279,14 @@ frappe.treeview_settings["Account"] = {
 						treeview.new_node();
 					}
 				},
-				"add"
+				"plus"
 			);
 		}
 	},
 	toolbar: [
 		{
 			label: __("Add Child"),
+			icon: "plus",
 			condition: function (node) {
 				return (
 					frappe.boot.user.can_create.indexOf("Account") !== -1 &&
@@ -272,6 +309,7 @@ frappe.treeview_settings["Account"] = {
 				return !node.root && frappe.boot.user.can_read.indexOf("GL Entry") !== -1;
 			},
 			label: __("View Ledger"),
+			icon: "book-open",
 			click: function (node, btn) {
 				frappe.route_options = {
 					from_date: erpnext.utils.get_fiscal_year(frappe.datetime.get_today(), true)[1],
@@ -286,6 +324,106 @@ frappe.treeview_settings["Account"] = {
 			},
 			btnClass: "hidden-xs",
 		},
+		{
+			// same label and mechanism as the Account form's Actions button:
+			// NOT frappe's generic rename (Allow Rename stays off) — this is
+			// ERPNext's controlled update that rebuilds the derived
+			// "number - name - abbr" document name
+			label: __("Update Account Name / Number"),
+			icon: "text-cursor-input",
+			condition: function (node) {
+				return !node.is_root && frappe.model.can_write("Account");
+			},
+			click: function (node) {
+				const dialog = new frappe.ui.Dialog({
+					title: __("Update Account Number / Name"),
+					fields: [
+						{
+							fieldtype: "Data",
+							fieldname: "account_name",
+							label: __("Account Name"),
+							reqd: 1,
+							default: node.data.account_name,
+						},
+						{
+							fieldtype: "Data",
+							fieldname: "account_number",
+							label: __("Account Number"),
+							default: node.data.account_number,
+						},
+					],
+					primary_action_label: __("Update"),
+					primary_action(values) {
+						dialog.hide();
+						frappe.dom.freeze(__("Updating {0}", [node.label]));
+						frappe.call({
+							method: "erpnext.accounts.doctype.account.account.update_account_number",
+							args: {
+								name: node.label,
+								account_name: values.account_name,
+								account_number: values.account_number,
+							},
+							callback: function (r) {
+								if (r.exc) return;
+								const treeview = frappe.views.trees["Account"];
+								node.parent_node && treeview.tree.load_children(node.parent_node);
+							},
+							always: function () {
+								frappe.dom.unfreeze();
+							},
+						});
+					},
+				});
+				dialog.show();
+			},
+		},
+		{
+			label: __("Convert to Group"),
+			icon: "folder-tree",
+			condition: function (node) {
+				return !node.is_root && !node.expandable && frappe.model.can_write("Account");
+			},
+			click: function (node) {
+				erpnext.accounts.convert_tree_node("Account", node, "convert_ledger_to_group");
+			},
+		},
+		{
+			label: __("Convert to Non-Group"),
+			icon: "file-text",
+			condition: function (node) {
+				// only on groups the user has opened and found empty — a
+				// group with children can't convert, so don't offer it
+				return (
+					!node.is_root &&
+					node.expandable &&
+					node.loaded &&
+					!node.$ul.children().length &&
+					frappe.model.can_write("Account")
+				);
+			},
+			click: function (node) {
+				erpnext.accounts.convert_tree_node("Account", node, "convert_group_to_ledger");
+			},
+		},
 	],
 	extend_toolbar: true,
 };
+
+frappe.provide("erpnext.accounts");
+// shared by the Account and Cost Center tree views (defined in both files,
+// whichever loads first wins): run the doctype's whitelisted convert method,
+// then re-render the branch so the node's group/leaf state updates
+erpnext.accounts.convert_tree_node =
+	erpnext.accounts.convert_tree_node ||
+	function (doctype, node, method) {
+		frappe.call({
+			method: "run_doc_method",
+			args: { dt: doctype, dn: node.label, method: method },
+			callback: function (r) {
+				if (r.exc) return;
+				const treeview = frappe.views.trees[doctype];
+				node.parent_node && treeview.tree.load_children(node.parent_node);
+				frappe.show_alert({ message: __("{0} converted", [node.label]), indicator: "green" });
+			},
+		});
+	};

erpnext/accounts/doctype/account/chart_of_accounts/chart_of_accounts.py

@@ -102,6 +102,8 @@ def identify_is_group(child):
 def get_chart(chart_template, existing_company=None):
 	chart = {}
 	if existing_company:
+		frappe.has_permission("Company", doc=existing_company, throw=True)
+
 		return get_account_tree_from_existing_company(existing_company)
 
 	elif chart_template == "Standard":

erpnext/accounts/doctype/account_category/account_category.json

@@ -40,6 +40,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "folder-tree",
  "index_web_pages_for_search": 1,
  "links": [
   {

erpnext/accounts/doctype/account_closing_balance/account_closing_balance.json

@@ -147,7 +147,7 @@
    "precision": "9"
   }
  ],
- "icon": "fa fa-list",
+ "icon": "scale",
  "in_create": 1,
  "links": [],
  "modified": "2025-08-22 19:13:50.400404",

erpnext/accounts/doctype/accounting_dimension/accounting_dimension.json

@@ -3,6 +3,7 @@
  "autoname": "field:label",
  "creation": "2019-05-04 18:13:37.002352",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/accounting-dimensions",
  "engine": "InnoDB",
  "field_order": [
   "document_type",
@@ -49,6 +50,7 @@
    "options": "Accounting Dimension Detail"
   }
  ],
+ "icon": "layers",
  "links": [],
  "modified": "2024-03-27 13:05:56.890002",
  "modified_by": "Administrator",

erpnext/accounts/doctype/accounting_dimension/accounting_dimension.py

@@ -235,8 +235,11 @@ def delete_accounting_dimension(doc):
 		frappe.clear_cache(doctype=doctype)
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def disable_dimension(doc):
+	# toggle_disabling rewrites a Custom Field site-wide, so demand the write that configures dimensions
+	frappe.has_permission("Accounting Dimension", "write", throw=True)
+
 	if frappe.in_test:
 		toggle_disabling(doc=doc)
 	else:

erpnext/accounts/doctype/accounting_dimension_filter/accounting_dimension_filter.js

@@ -6,7 +6,7 @@ frappe.ui.form.on("Accounting Dimension Filter", {
 		let help_content = `<table class="table table-bordered" style="background-color: var(--scrollbar-track-color);">
 				<tr><td>
 					<p>
-						<i class="fa fa-hand-right"></i>
+						<svg class="icon icon-sm"><use href="#icon-info"></use></svg>
 						{{__('Note: On checking Is Mandatory the accounting dimension will become mandatory against that specific account for all accounting transactions')}}
 					</p>
 				</td></tr>

erpnext/accounts/doctype/accounting_dimension_filter/accounting_dimension_filter.json

@@ -3,6 +3,7 @@
  "autoname": "format:{accounting_dimension}-{#####}",
  "creation": "2020-11-08 18:28:11.906146",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/accounting-dimension-filter",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -99,6 +100,7 @@
    "label": "Fieldname"
   }
  ],
+ "icon": "funnel",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2025-08-08 14:13:22.203011",

erpnext/accounts/doctype/accounting_period/accounting_period.json

@@ -3,6 +3,7 @@
  "autoname": "field:period_name",
  "creation": "2018-04-13 18:50:14.672323",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/accounting-period",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -77,6 +78,7 @@
    "options": "Role"
   }
  ],
+ "icon": "calendar-range",
  "links": [],
  "modified": "2026-03-09 17:15:33.577217",
  "modified_by": "Administrator",

erpnext/accounts/doctype/accounts_settings/accounts_settings.json

@@ -3,6 +3,7 @@
  "creation": "2013-06-24 15:49:57",
  "doctype": "DocType",
  "document_type": "Other",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/accounts-settings",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -793,7 +794,7 @@
   }
  ],
  "grid_page_length": 50,
- "icon": "icon-cog",
+ "icon": "settings",
  "idx": 1,
  "index_web_pages_for_search": 1,
  "issingle": 1,

erpnext/accounts/doctype/advance_payment_ledger_entry/advance_payment_ledger_entry.json

@@ -4,6 +4,7 @@
  "creation": "2024-10-16 16:57:12.085072",
  "doctype": "DocType",
  "engine": "InnoDB",
+ "icon": "book-open",
  "field_order": [
   "company",
   "voucher_type",

erpnext/accounts/doctype/bank/bank.json

@@ -6,6 +6,7 @@
  "creation": "2018-04-07 16:59:59.496668",
  "doctype": "DocType",
  "document_type": "Setup",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/bank",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -100,8 +101,9 @@
    "read_only": 1
   }
  ],
+ "icon": "landmark",
  "links": [],
- "modified": "2024-03-27 13:06:36.896195",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Bank",
@@ -118,6 +120,14 @@
    "role": "System Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Accounts Manager",
+   "select": 1
+  },
+  {
+   "role": "Accounts User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/bank_account/bank_account.json

@@ -5,6 +5,7 @@
  "creation": "2017-05-29 21:35:13.136357",
  "doctype": "DocType",
  "document_type": "Setup",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/bank-account",
  "engine": "InnoDB",
  "field_order": [
   "account_name",
@@ -227,6 +228,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "credit-card",
  "links": [
   {
    "group": "Transactions",
@@ -269,7 +271,7 @@
    "link_fieldname": "default_bank_account"
   }
  ],
- "modified": "2026-04-11 19:46:27.609994",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Bank Account",
@@ -299,6 +301,22 @@
    "role": "Accounts User",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/bank_account_balance/bank_account_balance.json

@@ -44,6 +44,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "wallet",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2026-06-16 22:17:48.007982",

erpnext/accounts/doctype/bank_account_subtype/bank_account_subtype.json

@@ -18,6 +18,7 @@
    "unique": 1
   }
  ],
+ "icon": "credit-card",
  "links": [],
  "modified": "2024-03-27 13:06:37.221876",
  "modified_by": "Administrator",

erpnext/accounts/doctype/bank_account_type/bank_account_type.json

@@ -18,6 +18,7 @@
    "unique": 1
   }
  ],
+ "icon": "credit-card",
  "links": [],
  "modified": "2024-03-27 13:06:37.347035",
  "modified_by": "Administrator",

erpnext/accounts/doctype/bank_clearance/bank_clearance.json

@@ -87,7 +87,7 @@
   }
  ],
  "hide_toolbar": 1,
- "icon": "fa fa-check",
+ "icon": "badge-check",
  "idx": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/bank_guarantee/bank_guarantee.json

@@ -5,6 +5,7 @@
  "creation": "2016-12-17 10:43:35.731631",
  "doctype": "DocType",
  "document_type": "Document",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/bank-guarantee",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -216,6 +217,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "shield-check",
  "is_submittable": 1,
  "links": [],
  "modified": "2026-05-25 18:12:10.768835",

erpnext/accounts/doctype/bank_guarantee/bank_guarantee.py

@@ -60,6 +60,9 @@ def get_voucher_details(bank_guarantee_type: str, reference_name: str):
 	if not isinstance(reference_name, str):
 		raise TypeError("reference_name must be a string")
 
+	# the form is the boundary, not the referenced order: an order guard would break one of the two roles
+	frappe.has_permission("Bank Guarantee", throw=True)
+
 	fields_to_fetch = ["grand_total"]
 
 	if bank_guarantee_type == "Receiving":

erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.js

@@ -68,6 +68,7 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 				frappe.msgprint(__("Please select Bank Account"));
 				return;
 			}
+			frm.events.validate_dates(frm);
 			frappe.call({
 				method: "erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool.auto_reconcile_vouchers",
 				args: {
@@ -82,7 +83,7 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 		});
 
 		frm.add_custom_button(__("Get Unreconciled Entries"), function () {
-			frm.trigger("make_reconciliation_tool");
+			return frm.trigger("make_reconciliation_tool");
 		});
 		frm.change_custom_button_type(__("Get Unreconciled Entries"), null, "primary");
 
@@ -106,7 +107,24 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 		frm.trigger("get_account_opening_balance");
 	},
 
+	validate_dates(frm) {
+		const from_date = frm.doc.filter_by_reference_date
+			? frm.doc.from_reference_date
+			: frm.doc.bank_statement_from_date;
+		const to_date = frm.doc.filter_by_reference_date
+			? frm.doc.to_reference_date
+			: frm.doc.bank_statement_to_date;
+		if (from_date && to_date && from_date > to_date) {
+			frappe.throw(
+				frm.doc.filter_by_reference_date
+					? __("From Reference Date cannot be greater than To Reference Date")
+					: __("From Date cannot be greater than To Date")
+			);
+		}
+	},
+
 	make_reconciliation_tool(frm) {
+		frm.events.validate_dates(frm);
 		frm.get_field("reconciliation_tool_cards").$wrapper.empty();
 		if (frm.doc.company && frm.doc.bank_account && frm.doc.bank_statement_to_date) {
 			frm.trigger("get_cleared_balance").then(() => {

erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.json

@@ -116,6 +116,7 @@
   }
  ],
  "hide_toolbar": 1,
+ "icon": "arrow-left-right",
  "index_web_pages_for_search": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.py

@@ -10,7 +10,7 @@ from frappe import _
 from frappe.model.document import Document
 from frappe.query_builder.custom import ConstantColumn
 from frappe.query_builder.functions import Sum
-from frappe.utils import cint, create_batch, flt
+from frappe.utils import cint, create_batch, flt, getdate
 
 from erpnext import get_default_cost_center
 from erpnext.accounts.doctype.bank_transaction.bank_transaction import get_total_allocated_amount
@@ -55,6 +55,8 @@ def get_bank_transactions(
 	all_transactions: bool = False,
 ):
 	# returns bank transactions for a bank account
+	validate_date_range(from_date, to_date)
+
 	filters = []
 	filters.append(["bank_account", "=", bank_account])
 	filters.append(["docstatus", "=", 1])
@@ -794,6 +796,7 @@ def create_bulk_payment_entry_and_reconcile(
 				"deposit",
 				"withdrawal",
 				"bank_account",
+				"company",
 				"currency",
 				"unallocated_amount",
 				"date",
@@ -828,11 +831,7 @@ def create_bulk_payment_entry_and_reconcile(
 				"paid_from": paid_from,
 				"paid_to": paid_to,
 				"paid_amount": bank_transaction.unallocated_amount,
-				"base_paid_amount": bank_transaction.unallocated_amount,
 				"received_amount": bank_transaction.unallocated_amount,
-				"base_received_amount": bank_transaction.unallocated_amount,
-				"target_exchange_rate": 1,
-				"source_exchange_rate": 1,
 				"reference_date": bank_transaction.date,
 				"posting_date": bank_transaction.date,
 				"reference_no": (bank_transaction.reference_number or bank_transaction.description or "")[
@@ -841,6 +840,8 @@ def create_bulk_payment_entry_and_reconcile(
 			}
 		)
 
+		set_multi_currency_amounts(payment_entry_doc)
+
 		payment_entry_doc.insert()
 		payment_entry_doc.submit()
 
@@ -879,6 +880,7 @@ def create_payment_entry_and_reconcile(bank_transaction_name: str | int, payment
 			"doctype": "Payment Entry",
 		}
 	)
+	set_multi_currency_amounts(payment_entry)
 	payment_entry.insert()
 	payment_entry.submit()
 	transaction = reconcile_vouchers(
@@ -901,6 +903,33 @@ def create_payment_entry_and_reconcile(bank_transaction_name: str | int, payment
 	}
 
 
+def set_multi_currency_amounts(pe):
+	"""Set real exchange rates when the bank and party accounts differ in currency."""
+	company_currency = frappe.get_cached_value("Company", pe.company, "default_currency")
+	pe.paid_from_account_currency = frappe.get_cached_value("Account", pe.paid_from, "account_currency")
+	pe.paid_to_account_currency = frappe.get_cached_value("Account", pe.paid_to, "account_currency")
+
+	pe.source_exchange_rate = (
+		1.0
+		if pe.paid_from_account_currency == company_currency
+		else get_exchange_rate(pe.paid_from_account_currency, company_currency, pe.posting_date)
+	)
+	pe.target_exchange_rate = (
+		1.0
+		if pe.paid_to_account_currency == company_currency
+		else get_exchange_rate(pe.paid_to_account_currency, company_currency, pe.posting_date)
+	)
+
+	# derive the party-side amount from the authoritative bank-side amount; Payment Entry books any
+	# rounding residual to Exchange Gain/Loss during validation (set_exchange_gain_loss)
+	if pe.payment_type == "Receive" and pe.source_exchange_rate:
+		base_amount = flt(pe.received_amount) * pe.target_exchange_rate
+		pe.paid_amount = flt(base_amount / pe.source_exchange_rate, pe.precision("paid_amount"))
+	elif pe.payment_type == "Pay" and pe.target_exchange_rate:
+		base_amount = flt(pe.paid_amount) * pe.source_exchange_rate
+		pe.received_amount = flt(base_amount / pe.target_exchange_rate, pe.precision("received_amount"))
+
+
 @frappe.whitelist(methods=["GET"])
 def search_for_transfer_transaction(transaction_id: str | int):
 	"""
@@ -969,6 +998,7 @@ def auto_reconcile_vouchers(
 	from_reference_date: str | date | None = None,
 	to_reference_date: str | date | None = None,
 ):
+	validate_date_range(from_date, to_date, filter_by_reference_date, from_reference_date, to_reference_date)
 	bank_transactions = get_bank_transactions(bank_account)
 
 	if len(bank_transactions) > 10:
@@ -1087,6 +1117,7 @@ def get_linked_payments(
 	to_reference_date: str | date | None = None,
 ):
 	# get all matching payments for a bank transaction
+	validate_date_range(from_date, to_date, filter_by_reference_date, from_reference_date, to_reference_date)
 	transaction = frappe.get_doc("Bank Transaction", bank_transaction_name)
 	bank_account = frappe.db.get_values(
 		"Bank Account", transaction.bank_account, ["account", "company"], as_dict=True
@@ -1106,6 +1137,23 @@ def get_linked_payments(
 	return subtract_allocations(gl_account, matching)
 
 
+def validate_date_range(
+	from_date,
+	to_date,
+	filter_by_reference_date=False,
+	from_reference_date=None,
+	to_reference_date=None,
+):
+	if cint(filter_by_reference_date):
+		from_date, to_date = from_reference_date, to_reference_date
+		message = _("From Reference Date cannot be greater than To Reference Date")
+	else:
+		message = _("From Date cannot be greater than To Date")
+
+	if from_date and to_date and getdate(from_date) > getdate(to_date):
+		frappe.throw(message)
+
+
 def subtract_allocations(gl_account, vouchers):
 	"Look up & subtract any existing Bank Transaction allocations"
 	copied = []

erpnext/accounts/doctype/bank_reconciliation_tool/test_bank_reconciliation_tool.py

@@ -2,12 +2,16 @@
 # See license.txt
 
 
+from unittest.mock import patch
+
 import frappe
 from frappe import qb
 from frappe.utils import add_days, today
 
 from erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool import (
 	auto_reconcile_vouchers,
+	create_bulk_payment_entry_and_reconcile,
+	create_payment_entry_and_reconcile,
 	get_auto_reconcile_message,
 	get_bank_transactions,
 	get_linked_payments,
@@ -16,6 +20,8 @@ from erpnext.accounts.doctype.payment_entry.test_payment_entry import create_pay
 from erpnext.accounts.test.accounts_mixin import AccountsTestMixin
 from erpnext.tests.utils import ERPNextTestSuite
 
+RATE_METHOD = "erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool.get_exchange_rate"
+
 
 class TestBankReconciliationTool(ERPNextTestSuite, AccountsTestMixin):
 	def setUp(self):
@@ -131,6 +137,33 @@ class TestBankReconciliationTool(ERPNextTestSuite, AccountsTestMixin):
 		names = [t.name for t in get_bank_transactions(self.bank_account, to_date=add_days(today(), -1))]
 		self.assertEqual(names, [])
 
+	def test_rejects_reversed_date_ranges(self):
+		from_date, to_date = today(), add_days(today(), -1)
+		with self.assertRaisesRegex(frappe.ValidationError, "From Date cannot be greater than To Date"):
+			get_bank_transactions(self.bank_account, from_date, to_date)
+
+		with self.assertRaisesRegex(
+			frappe.ValidationError, "From Reference Date cannot be greater than To Reference Date"
+		):
+			auto_reconcile_vouchers(
+				self.bank_account,
+				filter_by_reference_date=True,
+				from_reference_date=from_date,
+				to_reference_date=to_date,
+			)
+
+		transaction = self.make_bank_transaction(date=today())
+		with self.assertRaisesRegex(
+			frappe.ValidationError, "From Reference Date cannot be greater than To Reference Date"
+		):
+			get_linked_payments(
+				transaction.name,
+				["payment_entry"],
+				filter_by_reference_date=True,
+				from_reference_date=from_date,
+				to_reference_date=to_date,
+			)
+
 	def test_deposit_matches_amount_received_in_bank_account(self):
 		# money leaves another bank account and lands here minus a charge, so the two sides differ
 		payment = frappe.get_doc(
@@ -199,3 +232,117 @@ class TestBankReconciliationTool(ERPNextTestSuite, AccountsTestMixin):
 		self.assertIn("1 Transaction Partially Reconciled", singular)
 		plural, _ = get_auto_reconcile_message(["p1", "p2"], [])
 		self.assertIn("2 Transactions Partially Reconciled", plural)
+
+	def test_multi_currency_pay_converts_and_balances(self):
+		# withdrawal from an INR bank paying a USD supplier; rate 3.0 makes 100/3 non-exact
+		self.enable_multi_currency_setup()
+		pe = self.reconcile_new_payment(
+			self.make_multi_currency_txn(withdrawal=100),
+			payment_type="Pay",
+			party_type="Supplier",
+			party=self.supplier,
+			party_account=self.creditors_usd,
+			paid_from=self.bank,
+			paid_to=self.creditors_usd,
+			rate=3.0,
+		)
+		self.assertEqual(pe.docstatus, 1)  # submits despite the rounding residual
+		self.assertEqual((pe.source_exchange_rate, pe.target_exchange_rate), (1.0, 3.0))
+		self.assertEqual((pe.paid_amount, pe.received_amount), (100, 33.33))  # bank side kept, 100/3
+		self.assertEqual(pe.difference_amount, 0)
+		# Payment Entry auto-books the rounding residual to Exchange Gain/Loss
+		self.assertTrue(pe.deductions[0].is_exchange_gain_loss)
+		self.assertEqual(pe.deductions[0].amount, 0.01)  # 100 - 33.33 * 3
+
+	def test_multi_currency_receive_converts_and_balances(self):
+		# deposit into an INR bank from a USD customer; the party side must convert
+		self.enable_multi_currency_setup()
+		pe = self.reconcile_new_payment(
+			self.make_multi_currency_txn(deposit=100),
+			payment_type="Receive",
+			party_type="Customer",
+			party=self.customer,
+			party_account=self.debtors_usd,
+			paid_from=self.debtors_usd,
+			paid_to=self.bank,
+			rate=3.0,
+		)
+		self.assertEqual(pe.docstatus, 1)
+		self.assertEqual((pe.source_exchange_rate, pe.target_exchange_rate), (3.0, 1.0))
+		self.assertEqual((pe.received_amount, pe.paid_amount), (100, 33.33))  # bank side kept, 100/3
+		self.assertEqual(pe.difference_amount, 0)
+
+	def test_multi_currency_bulk_pay_converts_and_balances(self):
+		# the bulk path builds the Payment Entry itself, so it must convert too
+		self.enable_multi_currency_setup()
+		txn = self.make_multi_currency_txn(withdrawal=100)
+		with patch(RATE_METHOD, return_value=3.0):
+			result = create_bulk_payment_entry_and_reconcile(
+				[txn.name], "Supplier", self.supplier, self.creditors_usd
+			)
+
+		pe = frappe.get_doc("Payment Entry", result[0]["payment_entry"].name)
+		self.assertEqual(pe.docstatus, 1)
+		self.assertEqual(pe.target_exchange_rate, 3.0)
+		self.assertEqual((pe.paid_amount, pe.received_amount), (100, 33.33))
+		self.assertEqual(pe.difference_amount, 0)
+
+	def enable_multi_currency_setup(self):
+		# USD party/accounts + a company gain/loss account to absorb rounding residuals
+		self.company_abbr = "_TC"
+		self.create_supplier(supplier_name="_Test Supplier USD", currency="USD")
+		self.create_customer(customer_name="_Test Customer USD", currency="USD")
+		self.create_usd_payable_account()
+		self.create_usd_receivable_account()
+		self.set_party_account("Supplier", self.supplier, self.creditors_usd)
+		if not frappe.db.get_value("Company", self.company, "exchange_gain_loss_account"):
+			frappe.db.set_value(
+				"Company", self.company, "exchange_gain_loss_account", "Exchange Gain/Loss - _TC"
+			)
+
+	def set_party_account(self, party_type, party, account):
+		doc = frappe.get_doc(party_type, party)
+		if not any(row.company == self.company for row in doc.accounts):
+			doc.append("accounts", {"company": self.company, "account": account})
+			doc.save()
+
+	def make_multi_currency_txn(self, withdrawal=0, deposit=0):
+		return (
+			frappe.get_doc(
+				{
+					"doctype": "Bank Transaction",
+					"date": today(),
+					"withdrawal": withdrawal,
+					"deposit": deposit,
+					"bank_account": self.bank_account,
+					"currency": "INR",
+					"reference_number": "TEST-FX-REF",
+				}
+			)
+			.save()
+			.submit()
+		)
+
+	def reconcile_new_payment(
+		self, txn, *, payment_type, party_type, party, party_account, paid_from, paid_to, rate
+	):
+		# mimics the /banking frontend, which sends a hardcoded 1:1 rate
+		payment_entry_doc = {
+			"payment_type": payment_type,
+			"company": self.company,
+			"party_type": party_type,
+			"party": party,
+			"party_account": party_account,
+			"paid_from": paid_from,
+			"paid_to": paid_to,
+			"paid_amount": txn.unallocated_amount,
+			"received_amount": txn.unallocated_amount,
+			"source_exchange_rate": 1,
+			"target_exchange_rate": 1,
+			"posting_date": today(),
+			"reference_no": f"TEST-FX-{payment_type}",
+			"reference_date": today(),
+		}
+		with patch(RATE_METHOD, return_value=rate):
+			result = create_payment_entry_and_reconcile(txn.name, payment_entry_doc)
+		return frappe.get_doc("Payment Entry", result["payment_entry"].name)

erpnext/accounts/doctype/bank_statement_import/bank_statement_import.json

@@ -224,6 +224,7 @@
   }
  ],
  "hide_toolbar": 1,
+ "icon": "file-down",
  "links": [],
  "modified": "2026-05-30 20:51:10.353723",
  "modified_by": "Administrator",

erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py

@@ -436,6 +436,9 @@ def get_import_logs(docname: str):
 
 @frappe.whitelist()
 def upload_bank_statement(**args):
+	# The only caller routes into a new Bank Statement Import form, so `create` is the right to require.
+	frappe.has_permission("Bank Statement Import", "create", throw=True)
+
 	args = frappe._dict(args)
 	bsi = frappe.new_doc("Bank Statement Import")
 

erpnext/accounts/doctype/bank_statement_import_log/bank_statement_import_log.json

@@ -188,6 +188,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "file-clock",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2026-07-09 17:55:25.615942",

erpnext/accounts/doctype/bank_transaction/bank_transaction.json

@@ -4,6 +4,7 @@
  "autoname": "naming_series:",
  "creation": "2018-10-22 18:19:02.784533",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/bank-transaction",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -277,6 +278,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "arrow-left-right",
  "is_submittable": 1,
  "links": [],
  "modified": "2026-04-11 20:41:15.124085",

erpnext/accounts/doctype/bank_transaction/bank_transaction_upload.py

@@ -11,6 +11,10 @@ from frappe.utils.dateutils import parse_date
 
 @frappe.whitelist()
 def upload_bank_statement():
+	# Parsing a statement is the first step of creating Bank Transactions from it. Both functions here
+	# are reached only over HTTP, so there is no in-process caller to break.
+	frappe.has_permission("Bank Transaction", "create", throw=True)
+
 	if getattr(frappe, "uploaded_file", None):
 		with open(frappe.uploaded_file, "rb") as upfile:
 			fcontent = upfile.read()
@@ -34,8 +38,13 @@ def upload_bank_statement():
 	return {"columns": columns, "data": data}
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def create_bank_entries(columns, data, bank_account):
+	# insert()/submit() enforce this per document, but only after the loop has read each Bank Account
+	# and written an Error Log per rejected row. Check once up front.
+	frappe.has_permission("Bank Transaction", "create", throw=True)
+	frappe.has_permission("Bank Account", doc=bank_account, throw=True)
+
 	header_map = get_header_mapping(columns, bank_account)
 
 	success = 0

erpnext/accounts/doctype/bank_transaction_rule/bank_transaction_rule.json

@@ -140,6 +140,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "zap",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2026-04-11 21:36:26.754667",

erpnext/accounts/doctype/bisect_accounting_statements/bisect_accounting_statements.json

@@ -167,6 +167,7 @@
   }
  ],
  "hide_toolbar": 1,
+ "icon": "split",
  "index_web_pages_for_search": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/bisect_nodes/bisect_nodes.json

@@ -68,6 +68,7 @@
    "label": "Generated"
   }
  ],
+ "icon": "git-branch",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2024-03-27 13:06:39.766063",

erpnext/accounts/doctype/budget/budget.json

@@ -4,6 +4,7 @@
  "autoname": "naming_series:",
  "creation": "2016-05-16 11:42:29.632528",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/budgeting",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -330,6 +331,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "piggy-bank",
  "index_web_pages_for_search": 1,
  "is_submittable": 1,
  "links": [],

erpnext/accounts/doctype/cashier_closing/cashier_closing.json

@@ -122,6 +122,7 @@
    "read_only": 1
   }
  ],
+ "icon": "lock",
  "is_submittable": 1,
  "links": [],
  "modified": "2024-03-27 13:06:44.260440",

erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.js

@@ -16,6 +16,8 @@ frappe.ui.form.on("Chart of Accounts Importer", {
 				() => generate_tree_preview(frm),
 				() => create_import_button(frm),
 				() => frm.set_df_property("chart_preview", "hidden", 0),
+				// the preview is the point of this page — open it right away
+				() => frm.fields_dict.chart_preview.collapse(false),
 			]);
 		}
 
@@ -128,7 +130,6 @@ var create_import_button = function (frm) {
 				freeze_message: __("Creating Accounts..."),
 				callback: function (r) {
 					if (!r.exc) {
-						clearInterval(frm.page["interval"]);
 						frm.page.set_indicator(__("Import Successful"), "blue");
 						create_reset_button(frm);
 					}
@@ -142,42 +143,95 @@ var create_reset_button = function (frm) {
 	frm.page
 		.set_primary_action(__("Reset"), function () {
 			frm.page.clear_primary_action();
-			delete frm.page["show_import_button"];
 			frm.reload_doc();
 		})
 		.addClass("btn btn-primary");
 };
 
-var validate_coa = function (frm) {
-	if (frm.doc.import_file) {
-		let parent = __("All Accounts");
-		return frappe.call({
-			method: "erpnext.accounts.doctype.chart_of_accounts_importer.chart_of_accounts_importer.get_coa",
-			args: {
-				file_name: frm.doc.import_file,
-				parent: parent,
-				doctype: "Chart of Accounts Importer",
-				file_type: frm.doc.file_type,
-				for_validate: 1,
-			},
-			callback: function (r) {
-				if (r.message["show_import_button"]) {
-					frm.page["show_import_button"] = Boolean(r.message["show_import_button"]);
-				}
-			},
-		});
-	}
-};
-
 var generate_tree_preview = function (frm) {
 	let parent = __("All Accounts");
-	$(frm.fields_dict["chart_tree"].wrapper).empty(); // empty wrapper to load new data
+	const wrapper = $(frm.fields_dict["chart_tree"].wrapper).empty(); // empty wrapper to load new data
+
+	// search + expand/collapse-all lean on frappe.ui.Tree helpers added with
+	// row mode; when running against an older frappe that predates them, skip
+	// this toolbar so the preview still renders (just without the extras)
+	const has_row_helpers =
+		typeof frappe.ui.Tree.prototype.get_expansion_state === "function" &&
+		typeof frappe.ui.Tree.prototype.filter_nodes === "function";
+
+	let tree;
+	let deep_loaded = false;
+	let search_text = "";
+	let update_buttons = () => {};
+
+	if (has_row_helpers) {
+		// same toolbar anatomy as the tree view: search on the left,
+		// expand/collapse-all on the right (three-state: fully collapsed ->
+		// Expand All, fully expanded -> Collapse All, partially expanded -> both)
+		const $toolbar = $('<div class="flex items-center gap-2 mb-2"></div>').appendTo(wrapper);
+
+		const search_control = frappe.ui.form.make_control({
+			df: { fieldtype: "Data", fieldname: "preview_search", placeholder: __("Search") },
+			parent: $toolbar,
+			only_input: true,
+		});
+		search_control.refresh();
+		$(search_control.wrapper).addClass("m-0").css("width", "220px");
+		search_control.$input.addClass("input-xs");
+		search_control.$input.on(
+			"input",
+			frappe.utils.debounce(() => {
+				search_text = search_control.$input.val();
+				const run = () => {
+					// a newer keystroke superseded this one while the deep load ran
+					if (search_text !== search_control.$input.val()) return;
+					tree.filter_nodes(search_text);
+				};
+				if (!search_text || deep_loaded) {
+					run();
+					return;
+				}
+				tree.load_children(tree.root_node, true).then(() => {
+					deep_loaded = true;
+					run();
+				});
+			}, 300)
+		);
+
+		const $actions = $('<div class="ms-auto flex items-center gap-1"></div>').appendTo($toolbar);
+		update_buttons = () => {
+			const state = tree.get_expansion_state();
+			$expand_all.prop("disabled", !(state === "collapsed" || state === "partial"));
+			$collapse_all.prop("disabled", !(state === "expanded" || state === "partial"));
+		};
+		// tooltip on a wrapper: a disabled es-button has pointer-events:none,
+		// so hover falls through to the wrapper and the tooltip still shows
+		const make_action = (icon, label, onclick) => {
+			const $btn = $(
+				frappe.ui.button({ icon, disabled: true, onclick, attrs: { "aria-label": label } })
+			);
+			const $wrapper = $('<span class="inline-flex"></span>').append($btn).appendTo($actions);
+			frappe.ui.tooltip($wrapper, { text: label });
+			return $btn;
+		};
+		var $expand_all = make_action("chevrons-up-down", __("Expand All"), () => {
+			tree.load_children(tree.root_node, true).then(() => {
+				deep_loaded = true;
+			});
+		});
+		var $collapse_all = make_action("chevrons-down-up", __("Collapse All"), () => {
+			tree.load_children(tree.root_node, false);
+		});
+	}
 
 	// generate tree structure based on the csv data
-	return new frappe.ui.Tree({
-		parent: $(frm.fields_dict["chart_tree"].wrapper),
+	tree = new frappe.ui.Tree({
+		parent: wrapper,
 		label: parent,
 		expandable: true,
+		// read-only preview: row-mode visuals without actions or hover cards
+		// (ignored by an older frappe, which renders the legacy tree)
+		row_style: true,
 		method: "erpnext.accounts.doctype.chart_of_accounts_importer.chart_of_accounts_importer.get_coa",
 		args: {
 			file_name: frm.doc.import_file,
@@ -185,8 +239,9 @@ var generate_tree_preview = function (frm) {
 			doctype: "Chart of Accounts Importer",
 			file_type: frm.doc.file_type,
 		},
-		onclick: function (node) {
-			parent = node.value;
-		},
+		on_node_render: () => update_buttons(),
+		// expanded flips right after this callback — check on the next tick
+		on_click: () => setTimeout(update_buttons, 0),
 	});
+	return tree;
 };

erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.json

@@ -5,6 +5,7 @@
  "description": "Import Chart of Accounts from a csv file",
  "doctype": "DocType",
  "document_type": "Other",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/chart-of-accounts-importer",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -47,6 +48,7 @@
   }
  ],
  "hide_toolbar": 1,
+ "icon": "file-input",
  "in_create": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py

@@ -8,6 +8,7 @@ from functools import reduce
 
 import frappe
 from frappe import _
+from frappe.core.doctype.file.utils import find_file_by_url
 from frappe.desk.form.linked_with import get_linked_fields
 from frappe.model.document import Document
 from frappe.utils import cint, cstr
@@ -58,6 +59,8 @@ def validate_columns(data):
 
 @frappe.whitelist()
 def validate_company(company):
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	parent_company, allow_account_creation_against_child_company = frappe.get_cached_value(
 		"Company", company, ["parent_company", "allow_account_creation_against_child_company"]
 	)
@@ -110,7 +113,10 @@ def import_coa(file_name, company):
 
 
 def get_file(file_name):
-	file_doc = frappe.get_doc("File", {"file_url": file_name})
+	file_doc = find_file_by_url(file_name)
+	if not file_doc:
+		raise frappe.PermissionError
+
 	parts = file_doc.get_extension()
 	extension = parts[1]
 	extension = extension.lstrip(".")
@@ -177,6 +183,8 @@ def generate_data_from_excel(file_doc, extension, as_dict=False):
 def get_coa(doctype, parent, is_root=False, file_name=None, for_validate=0):
 	"""called by tree view (to fetch node's children)"""
 
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	file_doc, extension = get_file(file_name)
 	parent = None if parent == _("All Accounts") else parent
 
@@ -324,6 +332,8 @@ def build_response_as_excel(writer):
 
 @frappe.whitelist()
 def download_template(file_type, template_type, company):
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	writer = get_template(template_type, company)
 
 	if file_type == "CSV":
@@ -376,7 +386,6 @@ def get_sample_template(writer, company):
 	return writer
 
 
-@frappe.whitelist()
 def validate_accounts(file_doc, extension):
 	if extension == "csv":
 		accounts = generate_data_from_csv(file_doc, as_dict=True)

erpnext/accounts/doctype/cheque_print_template/cheque_print_template.json

@@ -4,6 +4,7 @@
  "autoname": "field:bank_name",
  "creation": "2016-05-04 14:35:00.402544",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/cheque-print-template",
  "engine": "InnoDB",
  "field_order": [
   "settings",
@@ -293,6 +294,7 @@
    "fieldtype": "HTML"
   }
  ],
+ "icon": "printer",
  "links": [],
  "max_attachments": 1,
  "modified": "2026-06-08 12:10:35.829531",

erpnext/accounts/doctype/cost_center/cost_center.json

@@ -7,6 +7,7 @@
  "description": "Track separate Income and Expense for product verticals or divisions.",
  "doctype": "DocType",
  "document_type": "Setup",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/cost-center",
  "engine": "InnoDB",
  "field_order": [
   "sb0",
@@ -122,11 +123,11 @@
    "label": "Disabled"
   }
  ],
- "icon": "fa fa-money",
+ "icon": "chart-pie",
  "idx": 1,
  "is_tree": 1,
  "links": [],
- "modified": "2026-04-14 18:15:27.367298",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Cost Center",
@@ -181,6 +182,54 @@
   {
    "role": "HR Manager",
    "select": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing User",
+   "select": 1
+  },
+  {
+   "role": "Projects Manager",
+   "select": 1
+  },
+  {
+   "role": "Projects User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/cost_center/cost_center_tree.js

@@ -12,6 +12,19 @@ frappe.treeview_settings["Cost Center"] = {
 	],
 	root_label: "Cost Centers",
 	get_tree_nodes: "erpnext.accounts.utils.get_children",
+	get_label: function (node) {
+		// clean display name — the number renders as a badge (see onrender)
+		return frappe.utils.escape_html(node.data.cost_center_name || node.title || node.label);
+	},
+	onrender: function (node) {
+		if (node.is_root || !node.data) return;
+
+		const flags = [];
+		if (node.data.cost_center_number) {
+			flags.push(frappe.ui.badge({ label: node.data.cost_center_number }));
+		}
+		erpnext.utils.render_tree_node_flags(node, flags);
+	},
 	add_tree_node: "erpnext.accounts.utils.add_cc",
 	menu_items: [
 		{
@@ -42,6 +55,37 @@ frappe.treeview_settings["Cost Center"] = {
 		},
 	],
 	ignore_fields: ["parent_cost_center"],
+	toolbar: [
+		{
+			label: __("Convert to Group"),
+			icon: "folder-tree",
+			condition: function (node) {
+				return !node.is_root && !node.expandable && frappe.model.can_write("Cost Center");
+			},
+			click: function (node) {
+				erpnext.accounts.convert_tree_node("Cost Center", node, "convert_ledger_to_group");
+			},
+		},
+		{
+			label: __("Convert to Non-Group"),
+			icon: "file-text",
+			condition: function (node) {
+				// only on groups the user has opened and found empty — a
+				// group with children can't convert, so don't offer it
+				return (
+					!node.is_root &&
+					node.expandable &&
+					node.loaded &&
+					!node.$ul.children().length &&
+					frappe.model.can_write("Cost Center")
+				);
+			},
+			click: function (node) {
+				erpnext.accounts.convert_tree_node("Cost Center", node, "convert_group_to_ledger");
+			},
+		},
+	],
+	extend_toolbar: true,
 	onload: function (treeview) {
 		function get_company() {
 			return treeview.page.fields_dict.company.get_value();
@@ -82,3 +126,22 @@ frappe.treeview_settings["Cost Center"] = {
 		);
 	},
 };
+
+frappe.provide("erpnext.accounts");
+// shared by the Account and Cost Center tree views (defined in both files,
+// whichever loads first wins): run the doctype's whitelisted convert method,
+// then re-render the branch so the node's group/leaf state updates
+erpnext.accounts.convert_tree_node =
+	erpnext.accounts.convert_tree_node ||
+	function (doctype, node, method) {
+		frappe.call({
+			method: "run_doc_method",
+			args: { dt: doctype, dn: node.label, method: method },
+			callback: function (r) {
+				if (r.exc) return;
+				const treeview = frappe.views.trees[doctype];
+				node.parent_node && treeview.tree.load_children(node.parent_node);
+				frappe.show_alert({ message: __("{0} converted", [node.label]), indicator: "green" });
+			},
+		});
+	};

erpnext/accounts/doctype/cost_center_allocation/cost_center_allocation.json

@@ -4,6 +4,7 @@
  "autoname": "CC-ALLOC-.#####",
  "creation": "2022-01-13 20:07:29.871109",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/cost_center_allocation",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -65,6 +66,7 @@
    "read_only": 1
   }
  ],
+ "icon": "chart-pie",
  "index_web_pages_for_search": 1,
  "is_submittable": 1,
  "links": [],

erpnext/accounts/doctype/coupon_code/coupon_code.js

@@ -5,7 +5,10 @@ frappe.ui.form.on("Coupon Code", {
 	setup: function (frm) {
 		frm.set_query("pricing_rule", function () {
 			return {
-				filters: [["Pricing Rule", "coupon_code_based", "=", "1"]],
+				filters: {
+					coupon_code_based: 1,
+					disable: 0,
+				},
 			};
 		});
 	},

erpnext/accounts/doctype/coupon_code/coupon_code.json

@@ -5,6 +5,7 @@
  "creation": "2018-01-22 14:34:39.701832",
  "doctype": "DocType",
  "document_type": "Other",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/coupon-code",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -124,8 +125,9 @@
    "label": "From External Ecomm Platform"
   }
  ],
+ "icon": "ticket-percent",
  "links": [],
- "modified": "2024-11-19 16:35:11.836441",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Coupon Code",
@@ -179,6 +181,14 @@
    "role": "Website Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
   }
  ],
  "sort_field": "creation",

erpnext/accounts/doctype/coupon_code/coupon_code.py

@@ -42,7 +42,23 @@ class CouponCode(Document):
 				self.coupon_code = frappe.generate_hash()[:10].upper()
 
 	def validate(self):
+		self.validate_from_to_dates("valid_from", "valid_upto")
+		self.validate_pricing_rule()
+
 		if self.coupon_type == "Gift Card":
 			self.maximum_use = 1
 			if not self.customer:
 				frappe.throw(_("Please select the customer."))
+
+	def validate_pricing_rule(self):
+		if not self.pricing_rule or self.from_external_ecomm_platform:
+			return
+
+		# Allow existing coupons to be updated after their pricing rule is disabled.
+		if not (
+			self.has_value_changed("pricing_rule") or self.has_value_changed("from_external_ecomm_platform")
+		):
+			return
+
+		if frappe.db.get_value("Pricing Rule", self.pricing_rule, "disable"):
+			frappe.throw(_("Pricing Rule {0} is disabled").format(frappe.bold(self.pricing_rule)))

erpnext/accounts/doctype/coupon_code/test_coupon_code.py

@@ -113,6 +113,43 @@ class TestCouponCode(ERPNextTestSuite):
 	def setUp(self):
 		test_create_test_data()
 
+	def test_disabled_pricing_rule_validation(self):
+		coupon = frappe.get_doc("Coupon Code", "SAVE30")
+		rule = frappe.get_doc("Pricing Rule", coupon.pricing_rule)
+		rule.disable = 1
+		rule.save()
+
+		with self.subTest("new coupon cannot select a disabled rule"):
+			new_coupon = frappe.copy_doc(coupon)
+			new_coupon.coupon_name = "Festival Savings"
+			new_coupon.coupon_code = "FESTSAVE"
+			with self.assertRaisesRegex(frappe.ValidationError, "is disabled"):
+				new_coupon.insert()
+
+		with self.subTest("existing coupon can retain a disabled rule"):
+			coupon.description = "Offer paused"
+			coupon.save()
+			coupon.reload()
+			self.assertEqual(coupon.description, "Offer paused")
+			self.assertEqual(coupon.pricing_rule, rule.name)
+
+		with self.subTest("existing coupon cannot switch to a disabled rule"):
+			disabled_rule = frappe.copy_doc(rule)
+			disabled_rule.insert()
+			coupon.reload()
+			coupon.pricing_rule = disabled_rule.name
+			with self.assertRaisesRegex(frappe.ValidationError, "is disabled"):
+				coupon.save()
+			coupon.reload()
+			self.assertEqual(coupon.pricing_rule, rule.name)
+
+	def test_cannot_save_coupon_with_reversed_validity_dates(self):
+		coupon = frappe.get_doc("Coupon Code", "SAVE30")
+		coupon.valid_from = "2026-09-17"
+		coupon.valid_upto = "2026-09-02"
+		with self.assertRaises(frappe.exceptions.InvalidDates):
+			coupon.save()
+
 	def test_sales_order_with_coupon_code(self):
 		frappe.db.set_value("Coupon Code", "SAVE30", "used", 0)
 

erpnext/accounts/doctype/currency_exchange_settings/currency_exchange_settings.json

@@ -2,6 +2,7 @@
  "actions": [],
  "creation": "2022-01-10 13:03:26.237081",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/currency-exchange-settings",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -101,6 +102,7 @@
    "label": "Use HTTP Protocol"
   }
  ],
+ "icon": "refresh-cw",
  "index_web_pages_for_search": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/dunning/dunning.json

@@ -4,6 +4,7 @@
  "autoname": "naming_series:",
  "creation": "2019-07-05 16:34:31.013238",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/dunning",
  "engine": "InnoDB",
  "field_order": [
   "naming_series",
@@ -397,6 +398,7 @@
    "fieldtype": "Column Break"
   }
  ],
+ "icon": "bell-ring",
  "is_submittable": 1,
  "links": [],
  "modified": "2026-05-30 23:18:04.712528",

erpnext/accounts/doctype/dunning_type/dunning_type.json

@@ -100,6 +100,7 @@
    "fieldtype": "Column Break"
   }
  ],
+ "icon": "bell",
  "links": [
   {
    "link_doctype": "Dunning",

erpnext/accounts/doctype/exchange_rate_revaluation/exchange_rate_revaluation.json

@@ -4,6 +4,7 @@
  "autoname": "ACC-ERR-.YYYY.-.#####",
  "creation": "2018-04-13 18:25:55.943587",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/exchange-rate-revaluation",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -107,6 +108,7 @@
    "precision": "9"
   }
  ],
+ "icon": "arrow-right-left",
  "is_submittable": 1,
  "links": [],
  "modified": "2024-03-27 13:09:42.951164",

erpnext/accounts/doctype/finance_book/finance_book.json

@@ -5,6 +5,7 @@
  "creation": "2018-04-13 17:42:43.252224",
  "doctype": "DocType",
  "document_type": "Document",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/finance-book",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -18,9 +19,9 @@
    "unique": 1
   }
  ],
- "icon": "fa fa-book",
+ "icon": "book",
  "links": [],
- "modified": "2024-03-27 13:09:44.514241",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Finance Book",
@@ -55,6 +56,18 @@
    "report": 1,
    "role": "Auditor",
    "share": 1
+  },
+  {
+   "role": "HR Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/financial_report_template/financial_report_template.js

@@ -236,6 +236,8 @@ async function refresh_tree_view(dialog, account_rows) {
 		parent: wrapper,
 		label: company,
 		root_value: company,
+		// read-only preview: row-mode visuals without actions
+		row_style: true,
 		method: "erpnext.accounts.doctype.financial_report_template.financial_report_engine.get_children_accounts",
 		args: { doctype: "Account", company: company, filtered_accounts: filtered_accounts, missed: missed },
 		toolbar: [],

erpnext/accounts/doctype/financial_report_template/financial_report_template.json

@@ -3,6 +3,7 @@
  "autoname": "field:template_name",
  "creation": "2025-08-02 04:44:15.184541",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/financial-report-template",
  "engine": "InnoDB",
  "field_order": [
   "template_name",
@@ -64,6 +65,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "file-spreadsheet",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2026-02-23 01:04:05.797161",

erpnext/accounts/doctype/fiscal_year/fiscal_year.json

@@ -6,6 +6,7 @@
  "description": "Represents a Financial Year. All accounting entries and other major transactions are tracked against the Fiscal Year.",
  "doctype": "DocType",
  "document_type": "Setup",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/fiscal-year",
  "engine": "InnoDB",
  "field_order": [
   "year",
@@ -79,10 +80,10 @@
    "set_only_once": 1
   }
  ],
- "icon": "fa fa-calendar",
+ "icon": "calendar",
  "idx": 1,
  "links": [],
- "modified": "2024-05-27 17:29:55.560840",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Fiscal Year",
@@ -131,6 +132,10 @@
   {
    "read": 1,
    "role": "Auditor"
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
   }
  ],
  "show_name_in_global_search": 1,

erpnext/accounts/doctype/gl_entry/gl_entry.json

@@ -376,7 +376,7 @@
    "precision": "9"
   }
  ],
- "icon": "fa fa-list",
+ "icon": "book-open",
  "idx": 1,
  "in_create": 1,
  "links": [],

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json

@@ -5,6 +5,7 @@
  "autoname": "ACC-INV-DISC-.YYYY.-.#####",
  "creation": "2019-03-07 12:01:56.296952",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/invoice_discounting",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -169,6 +170,7 @@
    "read_only": 1
   }
  ],
+ "icon": "ticket-percent",
  "is_submittable": 1,
  "links": [],
  "modified": "2026-09-09 17:04:59.512294",

erpnext/accounts/doctype/item_tax_template/item_tax_template.json

@@ -5,6 +5,7 @@
  "creation": "2022-01-19 01:09:13.297137",
  "doctype": "DocType",
  "document_type": "Setup",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/item-tax-template",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -56,8 +57,9 @@
    "fieldtype": "Section Break"
   }
  ],
+ "icon": "circle-percent",
  "links": [],
- "modified": "2024-03-27 13:09:55.573483",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Item Tax Template",
@@ -95,6 +97,54 @@
    "report": 1,
    "role": "Accounts User",
    "share": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Item Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock User",
+   "select": 1
   }
  ],
  "show_name_in_global_search": 1,

erpnext/accounts/doctype/journal_entry/journal_entry.json

@@ -6,6 +6,7 @@
  "creation": "2022-01-25 10:29:58.717206",
  "doctype": "DocType",
  "document_type": "Document",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/journal-entry",
  "engine": "InnoDB",
  "field_order": [
   "entry_type_and_date",
@@ -661,7 +662,7 @@
    "label": "Custom Remark"
   }
  ],
- "icon": "fa fa-file-text",
+ "icon": "notebook-pen",
  "idx": 176,
  "is_submittable": 1,
  "links": [

erpnext/accounts/doctype/journal_entry/journal_entry.py

@@ -1356,6 +1356,10 @@ def get_default_bank_cash_account(
 ):
 	from erpnext.accounts.doctype.sales_invoice.sales_invoice import get_bank_cash_account
 
+	# `select`, not `read`: this also runs server-side from get_payment_entry, and Auditor/HR User/Desk
+	# User hold only the select row on Company. doc= brings User Permissions to bear.
+	frappe.has_permission("Company", ptype="select", doc=company, throw=True)
+
 	if mode_of_payment:
 		account = get_bank_cash_account(mode_of_payment, company).get("account")
 
@@ -1384,6 +1388,10 @@ def get_default_bank_cash_account(
 					account = account_list[0].name
 
 	if account:
+		# `fetch_balance` is caller supplied, so authorise the account here rather than relying on
+		# get_balance_on(), which only checks on the branch that reads a balance.
+		frappe.has_permission("Account", doc=account, throw=True)
+
 		account_details = frappe.get_cached_value(
 			"Account", account, ["account_currency", "account_type"], as_dict=1
 		)
@@ -1568,30 +1576,39 @@ def get_against_jv(doctype, txt, searchfield, start, page_len, filters):
 	if not frappe.db.has_column("Journal Entry", searchfield):
 		return []
 
-	JournalEntry = frappe.qb.DocType("Journal Entry")
-	JournalEntryAccount = frappe.qb.DocType("Journal Entry Account")
+	account = filters.get("account")
+	party = filters.get("party")
 
-	query = (
-		frappe.qb.from_(JournalEntry)
-		.join(JournalEntryAccount)
-		.on(JournalEntryAccount.parent == JournalEntry.name)
-		.select(JournalEntry.name, JournalEntry.posting_date, JournalEntry.remark)
-		.where(JournalEntryAccount.account == filters.get("account"))
-		.where(JournalEntryAccount.reference_type.isnull() | (JournalEntryAccount.reference_type == ""))
-		.where(JournalEntry.docstatus == 1)
-		.where(JournalEntry[searchfield].like(f"%{txt}%"))
-		.orderby(JournalEntry.name, order=frappe.qb.desc)
-		.limit(page_len)
-		.offset(start)
+	# each names one value: a list would be read as a filter operator and widen the search.
+	for value in (account, party):
+		if value and not isinstance(value, str):
+			frappe.throw(_("Invalid filter"), frappe.PermissionError)
+
+	# get_list applies the permission query conditions; the child-table filter resolves the check to `read`
+	je_filters = [
+		["docstatus", "=", 1],
+		[searchfield, "like", f"%{txt}%"],
+		["Journal Entry Account", "account", "=", account],
+		["Journal Entry Account", "reference_type", "is", "not set"],
+	]
+	je_filters.append(
+		["Journal Entry Account", "party", "=", party]
+		if party
+		else ["Journal Entry Account", "party", "is", "not set"]
 	)
 
-	party = filters.get("party")
-	if party:
-		query = query.where(JournalEntryAccount.party == party)
-	else:
-		query = query.where(JournalEntryAccount.party.isnull() | (JournalEntryAccount.party == ""))
-
-	return query.run()
+	return frappe.get_list(
+		"Journal Entry",
+		filters=je_filters,
+		fields=["name", "posting_date", "remark"],
+		order_by="name desc",
+		limit_start=start,
+		limit_page_length=page_len,
+		as_list=True,
+		# one row per entry, not per matching account row. group_by rather than distinct: frappe
+		# drops ORDER BY from a distinct query on postgres, which would lose the ordering above.
+		group_by="name",
+	)
 
 
 @frappe.whitelist()
@@ -1810,6 +1827,10 @@ def make_reverse_journal_entry(source_name, target_doc=None):
 
 	def post_process(source, target):
 		target.reversal_of = source.name
+		target.naming_series = source.naming_series
+		if source.voucher_type == "Bank Entry":
+			target.cheque_no = source.cheque_no
+			target.cheque_date = source.cheque_date
 
 	doclist = get_mapped_doc(
 		"Journal Entry",

erpnext/accounts/doctype/journal_entry_template/journal_entry_template.json

@@ -4,6 +4,7 @@
  "creation": "2020-04-09 01:32:51.332301",
  "doctype": "DocType",
  "document_type": "Document",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/journal-entry-template",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -85,6 +86,7 @@
    "label": "Multi Currency"
   }
  ],
+ "icon": "notebook-text",
  "links": [],
  "modified": "2024-03-27 13:09:58.814734",
  "modified_by": "Administrator",

erpnext/accounts/doctype/ledger_health/ledger_health.json

@@ -40,6 +40,7 @@
    "label": "General and Payment Ledger mismatch"
   }
  ],
+ "icon": "heart-pulse",
  "in_create": 1,
  "index_web_pages_for_search": 1,
  "links": [],

erpnext/accounts/doctype/ledger_health_monitor/ledger_health_monitor.json

@@ -57,6 +57,7 @@
   }
  ],
  "hide_toolbar": 1,
+ "icon": "activity",
  "index_web_pages_for_search": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/ledger_merge/ledger_merge.json

@@ -92,6 +92,7 @@
   }
  ],
  "hide_toolbar": 1,
+ "icon": "merge",
  "links": [],
  "modified": "2024-03-27 13:10:02.198009",
  "modified_by": "Administrator",

erpnext/accounts/doctype/loyalty_point_entry/loyalty_point_entry.json

@@ -97,6 +97,7 @@
    "label": "Discretionary Reason"
   }
  ],
+ "icon": "star",
  "in_create": 1,
  "links": [],
  "modified": "2024-07-01 08:51:13.927009",

erpnext/accounts/doctype/loyalty_program/loyalty_program.js

@@ -8,7 +8,7 @@ frappe.ui.form.on("Loyalty Program", {
 		var help_content = `<table class="table table-bordered" style="background-color: var(--scrollbar-track-color);">
 				<tr><td>
 					<h4>
-						<i class="fa fa-hand-right"></i>
+						<svg class="icon icon-sm"><use href="#icon-info"></use></svg>
 						${__("Notes")}
 					</h4>
 					<ul>

erpnext/accounts/doctype/loyalty_program/loyalty_program.json

@@ -3,6 +3,7 @@
  "autoname": "field:loyalty_program_name",
  "creation": "2018-01-23 06:23:05.731431",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/loyalty-program",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -153,8 +154,9 @@
     "options": "Project"
   }
  ],
+ "icon": "gift",
  "links": [],
- "modified": "2024-03-27 13:10:03.361383",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Loyalty Program",
@@ -171,6 +173,14 @@
    "role": "System Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/loyalty_program/loyalty_program.py

@@ -96,6 +96,8 @@ def get_loyalty_program_details_with_points(
 	include_expired_entry=False,
 	current_transaction_amount=0,
 ):
+	frappe.has_permission("Customer", doc=customer, throw=True)
+
 	lp_details = get_loyalty_program_details(customer, loyalty_program, company=company, silent=silent)
 	loyalty_program = frappe.get_doc("Loyalty Program", loyalty_program)
 	loyalty_details = get_loyalty_details(
@@ -126,6 +128,10 @@ def get_loyalty_program_details(
 	silent=False,
 	include_expired_entry=False,
 ):
+	# The customer is what the caller is entitled to, not the programme: a check on Loyalty Program
+	# would be read-only to System Manager and deny every role that fills in the calling forms.
+	frappe.has_permission("Customer", doc=customer, throw=True)
+
 	lp_details = frappe._dict()
 
 	if not loyalty_program:
@@ -147,6 +153,13 @@ def get_loyalty_program_details(
 
 @frappe.whitelist()
 def get_redeemption_factor(loyalty_program=None, customer=None):
+	# both call sites send only `loyalty_program`, so the calling form is the boundary; the customer branch stays guarded
+	if not (frappe.has_permission("Sales Invoice") or frappe.has_permission("POS Invoice")):
+		frappe.throw(_("Not permitted"), frappe.PermissionError)
+
+	if customer:
+		frappe.has_permission("Customer", doc=customer, throw=True)
+
 	customer_loyalty_program = None
 	if not loyalty_program:
 		customer_loyalty_program = frappe.db.get_value("Customer", customer, "loyalty_program")

erpnext/accounts/doctype/mode_of_payment/mode_of_payment.json

@@ -6,6 +6,7 @@
  "creation": "2012-12-04 17:49:20",
  "doctype": "DocType",
  "document_type": "Setup",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/mode-of-payment",
  "engine": "InnoDB",
  "field_order": [
   "mode_of_payment",
@@ -44,11 +45,11 @@
    "label": "Enabled"
   }
  ],
- "icon": "fa fa-credit-card",
+ "icon": "wallet",
  "idx": 1,
  "index_web_pages_for_search": 1,
  "links": [],
- "modified": "2026-04-14 18:16:47.795986",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Mode of Payment",
@@ -76,6 +77,30 @@
   {
    "role": "HR Manager",
    "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/monthly_distribution/monthly_distribution.json

@@ -43,10 +43,10 @@
    "options": "Monthly Distribution Percentage"
   }
  ],
- "icon": "fa fa-bar-chart",
+ "icon": "chart-bar",
  "idx": 1,
  "links": [],
- "modified": "2024-03-27 13:10:05.873547",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Monthly Distribution",
@@ -69,6 +69,10 @@
    "read": 1,
    "report": 1,
    "role": "Accounts Manager"
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
   }
  ],
  "sort_field": "creation",

erpnext/accounts/doctype/opening_invoice_creation_tool/opening_invoice_creation_tool.json

@@ -3,6 +3,7 @@
  "allow_copy": 1,
  "creation": "2017-08-29 02:22:54.947711",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/opening-invoice-creation-tool",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -87,6 +88,7 @@
   }
  ],
  "hide_toolbar": 1,
+ "icon": "file-plus",
  "issingle": 1,
  "links": [],
  "modified": "2026-05-30 23:18:48.691227",

erpnext/accounts/doctype/party_link/party_link.json

@@ -50,6 +50,7 @@
    "options": "secondary_role"
   }
  ],
+ "icon": "link",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2024-03-27 13:10:08.607170",

erpnext/accounts/doctype/payment_entry/payment_entry.js

@@ -422,21 +422,17 @@ frappe.ui.form.on("Payment Entry", {
 
 	show_general_ledger: function (frm) {
 		if (frm.doc.docstatus > 0) {
-			frm.add_custom_button(
-				__("Ledger"),
-				function () {
-					frappe.route_options = {
-						voucher_no: frm.doc.name,
-						from_date: frm.doc.posting_date,
-						to_date: moment(frm.doc.modified).format("YYYY-MM-DD"),
-						company: frm.doc.company,
-						categorize_by: "",
-						show_cancelled_entries: frm.doc.docstatus === 2,
-					};
-					frappe.set_route("query-report", "General Ledger");
-				},
-				"fa fa-table"
-			);
+			frm.add_custom_button(__("Ledger"), function () {
+				frappe.route_options = {
+					voucher_no: frm.doc.name,
+					from_date: frm.doc.posting_date,
+					to_date: moment(frm.doc.modified).format("YYYY-MM-DD"),
+					company: frm.doc.company,
+					categorize_by: "",
+					show_cancelled_entries: frm.doc.docstatus === 2,
+				};
+				frappe.set_route("query-report", "General Ledger");
+			});
 		}
 	},
 

erpnext/accounts/doctype/payment_entry/payment_entry.json

@@ -5,6 +5,7 @@
  "autoname": "naming_series:",
  "creation": "2016-06-01 14:38:51.012597",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/payment-entry",
  "engine": "InnoDB",
  "field_order": [
   "type_of_payment",
@@ -784,6 +785,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "banknote",
  "index_web_pages_for_search": 1,
  "is_submittable": 1,
  "links": [

erpnext/accounts/doctype/payment_gateway_account/payment_gateway_account.json

@@ -84,6 +84,7 @@
    "reqd": 1
   }
  ],
+ "icon": "credit-card",
  "index_web_pages_for_search": 1,
  "links": [],
  "modified": "2025-07-14 16:49:55.210352",

erpnext/accounts/doctype/payment_ledger_entry/payment_ledger_entry.json

@@ -5,6 +5,7 @@
  "doctype": "DocType",
  "editable_grid": 1,
  "engine": "InnoDB",
+ "icon": "book-open",
  "field_order": [
   "posting_date",
   "company",

erpnext/accounts/doctype/payment_order/payment_order.json

@@ -3,6 +3,7 @@
  "autoname": "naming_series:",
  "creation": "2018-07-20 16:43:08.505978",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/payment-order",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -107,6 +108,7 @@
    "label": "Account"
   }
  ],
+ "icon": "send",
  "is_submittable": 1,
  "links": [],
  "modified": "2024-03-27 13:10:10.186727",

erpnext/accounts/doctype/payment_order/payment_order.py

@@ -57,26 +57,56 @@ class PaymentOrder(Document):
 			frappe.db.set_value(self.payment_order_type, d.get(ref_doc_field), ref_field, status)
 
 
+def _readable_payment_order(filters):
+	"""Authorise the parent before reading its rows.
+
+	A child table carries no permissions of its own, so a read of it has to be authorised on the
+	Payment Order the rows belong to.
+	"""
+	parent = filters.get("parent")
+	if not parent or not frappe.db.exists("Payment Order", parent):
+		return None
+
+	ptype = "select" if frappe.only_has_select_perm("Payment Order") else "read"
+	frappe.has_permission("Payment Order", ptype, doc=parent, throw=True)
+	return parent
+
+
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_mop_query(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		""" select mode_of_payment from `tabPayment Order Reference`
-		where parent = %(parent)s and mode_of_payment like %(txt)s
-		limit %(page_len)s offset %(start)s""",
-		{"parent": filters.get("parent"), "start": start, "page_len": page_len, "txt": "%%%s%%" % txt},
+	if not _readable_payment_order(filters):
+		return []
+
+	return frappe.get_all(
+		"Payment Order Reference",
+		filters={"parent": filters.get("parent"), "mode_of_payment": ["like", f"%{txt}%"]},
+		fields=["mode_of_payment"],
+		limit_start=start,
+		limit_page_length=page_len,
+		order_by="",  # match the original query (no ORDER BY); avoid get_all's default sort
+		as_list=True,
 	)
 
 
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_supplier_query(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		""" select supplier from `tabPayment Order Reference`
-		where parent = %(parent)s and supplier like %(txt)s and
-		(payment_reference is null or payment_reference='')
-		limit %(page_len)s offset %(start)s""",
-		{"parent": filters.get("parent"), "start": start, "page_len": page_len, "txt": "%%%s%%" % txt},
+	if not _readable_payment_order(filters):
+		return []
+
+	return frappe.get_all(
+		"Payment Order Reference",
+		filters={
+			"parent": filters.get("parent"),
+			"supplier": ["like", f"%{txt}%"],
+			"payment_reference": ["is", "not set"],
+		},
+		fields=["supplier"],
+		limit_start=start,
+		limit_page_length=page_len,
+		order_by="",  # match the original query (no ORDER BY); avoid get_all's default sort
+		as_list=True,
 	)
 
 

erpnext/accounts/doctype/payment_reconciliation/payment_reconciliation.json

@@ -3,6 +3,7 @@
  "allow_copy": 1,
  "creation": "2014-07-09 12:04:51.681583",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/payment-reconciliation",
  "engine": "InnoDB",
  "field_order": [
   "company",
@@ -235,7 +236,7 @@
   }
  ],
  "hide_toolbar": 1,
- "icon": "icon-resize-horizontal",
+ "icon": "arrow-left-right",
  "is_virtual": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/payment_request/payment_request.json

@@ -3,6 +3,7 @@
  "autoname": "naming_series:",
  "creation": "2015-12-15 22:23:24.745065",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/payment-request",
  "engine": "InnoDB",
  "field_order": [
   "payment_request_type",
@@ -474,6 +475,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "hand-coins",
  "in_create": 1,
  "index_web_pages_for_search": 1,
  "is_submittable": 1,

erpnext/accounts/doctype/payment_term/payment_term.json

@@ -5,6 +5,7 @@
  "autoname": "field:payment_term_name",
  "creation": "2017-08-10 15:24:54.876365",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/payment-terms",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -115,8 +116,9 @@
    "fieldtype": "Column Break"
   }
  ],
+ "icon": "calendar-clock",
  "links": [],
- "modified": "2024-03-27 13:10:11.511137",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Payment Term",
@@ -157,6 +159,30 @@
    "role": "Accounts User",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/payment_terms_template/payment_terms_template.json

@@ -5,6 +5,7 @@
  "autoname": "field:template_name",
  "creation": "2017-08-10 15:34:28.058054",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/payment-terms-template",
  "editable_grid": 1,
  "engine": "InnoDB",
  "field_order": [
@@ -34,6 +35,7 @@
    "label": "Allocate Payment Based On Payment Terms"
   }
  ],
+ "icon": "calendar-clock",
  "links": [],
  "modified": "2024-04-07 11:26:42.021585",
  "modified_by": "Administrator",

erpnext/accounts/doctype/pegged_currencies/pegged_currencies.json

@@ -20,6 +20,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "anchor",
  "index_web_pages_for_search": 1,
  "issingle": 1,
  "links": [],

erpnext/accounts/doctype/period_closing_voucher/period_closing_voucher.js

@@ -41,21 +41,17 @@ frappe.ui.form.on("Period Closing Voucher", {
 
 	refresh: function (frm) {
 		if (frm.doc.docstatus > 0) {
-			frm.add_custom_button(
-				__("Ledger"),
-				function () {
-					frappe.route_options = {
-						voucher_no: frm.doc.name,
-						from_date: frm.doc.period_start_date,
-						to_date: frm.doc.period_end_date,
-						company: frm.doc.company,
-						categorize_by: "",
-						show_cancelled_entries: frm.doc.docstatus === 2,
-					};
-					frappe.set_route("query-report", "General Ledger");
-				},
-				"fa fa-table"
-			);
+			frm.add_custom_button(__("Ledger"), function () {
+				frappe.route_options = {
+					voucher_no: frm.doc.name,
+					from_date: frm.doc.period_start_date,
+					to_date: frm.doc.period_end_date,
+					company: frm.doc.company,
+					categorize_by: "",
+					show_cancelled_entries: frm.doc.docstatus === 2,
+				};
+				frappe.set_route("query-report", "General Ledger");
+			});
 		}
 	},
 });

erpnext/accounts/doctype/period_closing_voucher/period_closing_voucher.json

@@ -3,6 +3,7 @@
  "autoname": "ACC-PCV-.YYYY.-.#####",
  "creation": "2013-01-10 16:34:07",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/period-closing-voucher",
  "engine": "InnoDB",
  "field_order": [
   "transaction_date",
@@ -110,7 +111,7 @@
    "reqd": 1
   }
  ],
- "icon": "fa fa-file-text",
+ "icon": "folder-lock",
  "idx": 1,
  "is_submittable": 1,
  "links": [],

erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.json

@@ -254,6 +254,7 @@
   }
  ],
  "grid_page_length": 50,
+ "icon": "book-lock",
  "is_submittable": 1,
  "links": [
   {

erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py

@@ -254,6 +254,13 @@ class POSClosingEntry(StatusUpdater):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_cashiers(doctype, txt, searchfield, start, page_len, filters):
+	pos_profile = filters.get("parent")
+	if not pos_profile or not frappe.db.exists("POS Profile", pos_profile):
+		return []
+
+	ptype = "select" if frappe.only_has_select_perm("POS Profile") else "read"
+	frappe.has_permission("POS Profile", ptype, doc=pos_profile, throw=True)
+
 	cashiers_list = frappe.get_all("POS Profile User", filters=filters, fields=["user"], as_list=1)
 	return [c for c in cashiers_list]
 

erpnext/accounts/doctype/pos_invoice/pos_invoice.json

@@ -1634,10 +1634,10 @@
    "print_hide": 1
   }
  ],
- "icon": "fa fa-file-text",
+ "icon": "receipt-text",
  "is_submittable": 1,
  "links": [],
- "modified": "2026-08-12 12:00:00.000000",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "POS Invoice",
@@ -1680,6 +1680,14 @@
    "permlevel": 1,
    "read": 1,
    "role": "All"
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/pos_invoice/pos_invoice.py

@@ -899,6 +899,19 @@ class POSInvoice(SalesInvoice):
 
 @frappe.whitelist()
 def get_stock_availability(item_code, warehouse):
+	# select-or-read on POS Profile: a bare check defaults to `read`, which Sales Manager lacks.
+	# The profile is the only boundary that fits -- Item and Bin read both exclude Accounts Manager.
+	ptype = "select" if frappe.only_has_select_perm("POS Profile") else "read"
+	frappe.has_permission("POS Profile", ptype, throw=True)
+
+	# the caller picks the warehouse when allow_warehouse_change is set; costs nobody who has no
+	# Warehouse User Permission
+	from frappe.permissions import get_allowed_docs_for_doctype, get_user_permissions
+
+	if warehouse_permissions := get_user_permissions(frappe.session.user).get("Warehouse"):
+		allowed_warehouses = get_allowed_docs_for_doctype(warehouse_permissions, "POS Invoice")
+		if allowed_warehouses and warehouse not in allowed_warehouses:
+			frappe.throw(_("Not permitted for {0}").format(warehouse), frappe.PermissionError)
 	if frappe.db.get_value("Item", item_code, "is_stock_item"):
 		is_stock_item = True
 		bin_qty = get_bin_qty(item_code, warehouse)

erpnext/accounts/doctype/pos_invoice_merge_log/pos_invoice_merge_log.json

@@ -126,6 +126,7 @@
    "reqd": 1
   }
  ],
+ "icon": "merge",
  "index_web_pages_for_search": 1,
  "is_submittable": 1,
  "links": [],

erpnext/accounts/doctype/pos_invoice_merge_log/pos_invoice_merge_log.py

@@ -9,6 +9,7 @@ import frappe
 from frappe import _
 from frappe.model.document import Document
 from frappe.model.mapper import map_child_doc, map_doc
+from frappe.query_builder import DocType
 from frappe.utils import cint, flt, get_time, getdate, nowdate, nowtime
 from frappe.utils.background_jobs import enqueue, is_job_enqueued
 from frappe.utils.scheduler import is_scheduler_inactive
@@ -16,7 +17,6 @@ from frappe.utils.scheduler import is_scheduler_inactive
 from erpnext.accounts.doctype.accounting_dimension.accounting_dimension import (
 	get_checks_for_pl_and_bs_accounts,
 )
-from erpnext.controllers.sales_and_purchase_return import get_sales_invoice_item_from_consolidated_invoice
 
 
 class POSInvoiceMergeLog(Document):
@@ -214,6 +214,8 @@ class POSInvoiceMergeLog(Document):
 
 		loyalty_amount_sum, loyalty_points_sum, idx = 0, 0, 1
 
+		reversed_rows = get_reversed_rows([doc.return_against for doc in data if doc.is_return])
+
 		for doc in data:
 			old_new_item_map = frappe._dict()
 			old_new_tax_map = frappe._dict()
@@ -238,9 +240,13 @@ class POSInvoiceMergeLog(Document):
 				si_item.pos_invoice = doc.name
 				si_item.pos_invoice_item = item.name
 				if doc.is_return:
-					si_item.sales_invoice_item = get_sales_invoice_item_from_consolidated_invoice(
-						doc.return_against, item.pos_invoice_item
-					)
+					reversed_row = reversed_rows.get(item.pos_invoice_item) or frappe._dict()
+					si_item.sales_invoice_item = reversed_row.get("name")
+					# quote the rate of the row being reversed: rounding an invoice-level discount
+					# can leave a return's net rate a minor unit above the sale's, and
+					# validate_returned_items refuses a return priced above its original
+					if si_item.sales_invoice_item:
+						si_item.rate = reversed_row.rate
 				if item.serial_and_batch_bundle:
 					si_item.serial_and_batch_bundle = item.serial_and_batch_bundle
 				items.append(si_item)
@@ -432,6 +438,28 @@ class POSInvoiceMergeLog(Document):
 			si.cancel()
 
 
+def get_reversed_rows(return_against):
+	"""Rows of the consolidated sales these returns reverse, keyed by the POS invoice row."""
+	if not return_against:
+		return {}
+
+	sales_invoice = DocType("Sales Invoice")
+	sales_invoice_item = DocType("Sales Invoice Item")
+
+	rows = (
+		frappe.qb.from_(sales_invoice)
+		.from_(sales_invoice_item)
+		.select(sales_invoice_item.name, sales_invoice_item.rate, sales_invoice_item.pos_invoice_item)
+		.where(
+			(sales_invoice.name == sales_invoice_item.parent)
+			& (sales_invoice.is_return == 0)
+			& (sales_invoice_item.pos_invoice.isin(return_against))
+		)
+	).run(as_dict=True)
+
+	return {row.pos_invoice_item: row for row in rows}
+
+
 def get_all_unconsolidated_invoices():
 	filters = {
 		"consolidated_invoice": ["in", ["", None]],

erpnext/accounts/doctype/pos_invoice_merge_log/test_pos_invoice_merge_log.py

@@ -1,8 +1,10 @@
 # Copyright (c) 2020, Frappe Technologies Pvt. Ltd. and Contributors
 # See license.txt
 import json
+from contextlib import contextmanager
 
 import frappe
+from frappe.utils import flt
 
 from erpnext.accounts.doctype.mode_of_payment.test_mode_of_payment import (
 	set_default_account_for_mode_of_payment,
@@ -21,6 +23,67 @@ from erpnext.stock.doctype.stock_entry.stock_entry_utils import make_stock_entry
 from erpnext.tests.utils import ERPNextTestSuite
 
 
+@contextmanager
+def rounding_method(method):
+	"""System Settings is also cached on frappe.local, so that copy has to go as well."""
+	previous = frappe.db.get_single_value("System Settings", "rounding_method")
+	try:
+		frappe.db.set_single_value("System Settings", "rounding_method", method)
+		frappe.local.system_settings = None
+		yield
+	finally:
+		frappe.db.set_single_value("System Settings", "rounding_method", previous)
+		frappe.local.system_settings = None
+
+
+def sell_over_the_counter(lines, discount_percentage=0):
+	item_code, qty, rate = lines[0]
+	sale = create_pos_invoice(item_code=item_code, qty=qty, rate=rate, do_not_save=True)
+	for item_code, qty, rate in lines[1:]:
+		sale.append(
+			"items",
+			{
+				"item_code": item_code,
+				"qty": qty,
+				"rate": rate,
+				"price_list_rate": rate,
+				"warehouse": "_Test Warehouse - _TC",
+				"income_account": "Sales - _TC",
+				"cost_center": "_Test Cost Center - _TC",
+			},
+		)
+
+	if discount_percentage:
+		sale.apply_discount_on = "Net Total"
+		sale.additional_discount_percentage = discount_percentage
+
+	sale.run_method("calculate_taxes_and_totals")
+	payable = sale.rounded_total or sale.grand_total
+	sale.append("payments", {"mode_of_payment": "Cash", "account": "Cash - _TC", "amount": payable})
+	sale.paid_amount = sale.base_paid_amount = payable
+	sale.insert()
+	sale.submit()
+	return sale
+
+
+def refund_over_the_counter(sale, qty=None):
+	"""Hand back every line of `sale`, `qty` of each when fewer units come back."""
+	note = make_sales_return(sale.name)
+	if qty is not None:
+		for item in note.items:
+			item.qty = qty
+
+	note.run_method("calculate_taxes_and_totals")
+	refundable = note.rounded_total or note.grand_total
+	note.payments[0].amount = refundable
+	for spare in note.payments[1:]:
+		spare.amount = 0
+	note.paid_amount = note.base_paid_amount = refundable
+	note.insert()
+	note.submit()
+	return note
+
+
 class TestPOSInvoiceMergeLog(ERPNextTestSuite):
 	def setUp(self):
 		mode_of_payment = frappe.get_doc("Mode of Payment", "Bank Draft")
@@ -479,3 +542,81 @@ class TestPOSInvoiceMergeLog(ERPNextTestSuite):
 			"POS Invoice Merge Log", {"pos_closing_entry": closing_entry.name}, "company"
 		)
 		self.assertEqual(pos_merge_log_company, closing_entry.company)
+
+	@ERPNextTestSuite.change_settings("Selling Settings", {"allow_multiple_items": 1})
+	def test_consolidating_returns_priced_off_a_rounded_invoice_discount(self):
+		"""A return works out its own share of an invoice-level discount, so rounding can leave
+		it a minor unit above the sale's, and validate_returned_items then refuses it.
+
+		Every shape that reaches a consolidated credit note goes through one closing entry:
+		a split landing on a half minor unit, the same item on two rows so the rows can only
+		be paired through sales_invoice_item, fewer units coming back than went out, and — as
+		a control — a sale with no invoice-level discount to split at all.
+		"""
+		for item_code in ("_Test Item", "_Test Item 2"):
+			make_stock_entry(to_warehouse="_Test Warehouse - _TC", item_code=item_code, rate=100, qty=40)
+
+		with rounding_method("Banker's Rounding (legacy)"):
+			tied = sell_over_the_counter(
+				[("_Test Item", 1, 42.86), ("_Test Item 2", 1, 57.14)], discount_percentage=25
+			)
+			repeated = sell_over_the_counter(
+				[("_Test Item", 1, 42.86), ("_Test Item", 1, 57.14)], discount_percentage=25
+			)
+			oversold = sell_over_the_counter(
+				[("_Test Item", 3, 42.86), ("_Test Item 2", 3, 57.14)], discount_percentage=25
+			)
+			undiscounted = sell_over_the_counter([("_Test Item", 1, 42.86), ("_Test Item 2", 1, 57.14)])
+
+			# the sale and the return really do round the split apart
+			self.assertEqual(
+				{item.item_code: item.net_rate for item in tied.items},
+				{"_Test Item": 32.15, "_Test Item 2": 42.85},
+			)
+			returns = [
+				refund_over_the_counter(tied),
+				refund_over_the_counter(repeated),
+				refund_over_the_counter(oversold, qty=-1),
+				refund_over_the_counter(undiscounted),
+			]
+			self.assertEqual(
+				{item.item_code: item.net_rate for item in returns[0].items},
+				{"_Test Item": 32.14, "_Test Item 2": 42.86},
+			)
+
+			self.make_closing_entry()
+
+		for pos_invoice in [tied, repeated, oversold, undiscounted, *returns]:
+			pos_invoice.load_from_db()
+			self.assertTrue(
+				frappe.db.exists("Sales Invoice", pos_invoice.consolidated_invoice),
+				f"{pos_invoice.name} was not consolidated",
+			)
+			self.assertEqual(
+				frappe.db.get_value("Sales Invoice", pos_invoice.consolidated_invoice, "outstanding_amount"),
+				0,
+			)
+
+		for note in returns:
+			# no returned row may be priced above the row it reverses
+			for row in frappe.get_all(
+				"Sales Invoice Item",
+				filters={"parent": note.consolidated_invoice},
+				fields=["item_code", "rate", "sales_invoice_item"],
+			):
+				self.assertTrue(row.sales_invoice_item, f"{row.item_code} lost its link to the sale")
+				sold_rate = frappe.db.get_value("Sales Invoice Item", row.sales_invoice_item, "rate")
+				self.assertLessEqual(row.rate, sold_rate)
+
+		# returns for one customer land on a single credit note, which still adds up to
+		# everything handed back over the counter
+		refunded = {}
+		for note in returns:
+			refunded[note.consolidated_invoice] = refunded.get(note.consolidated_invoice, 0) + flt(
+				note.grand_total
+			)
+		for consolidated_name, handed_back in refunded.items():
+			self.assertEqual(
+				flt(frappe.db.get_value("Sales Invoice", consolidated_name, "grand_total"), 2),
+				flt(handed_back, 2),
+			)

erpnext/accounts/doctype/pos_opening_entry/pos_opening_entry.json

@@ -129,6 +129,7 @@
    "reqd": 1
   }
  ],
+ "icon": "folder-open",
  "is_submittable": 1,
  "links": [],
  "modified": "2024-03-27 13:10:16.034296",

erpnext/accounts/doctype/pos_profile/pos_profile.json

@@ -4,6 +4,7 @@
  "autoname": "Prompt",
  "creation": "2013-05-24 12:15:51",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/pos-profile",
  "engine": "InnoDB",
  "field_order": [
   "company",
@@ -545,7 +546,7 @@
   }
  ],
  "grid_page_length": 50,
- "icon": "icon-cog",
+ "icon": "monitor",
  "idx": 1,
  "index_web_pages_for_search": 1,
  "links": [
@@ -570,7 +571,7 @@
    "link_fieldname": "pos_profile"
   }
  ],
- "modified": "2026-05-26 12:07:48.597412",
+ "modified": "2026-09-16 11:42:07.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "POS Profile",
@@ -594,6 +595,10 @@
    "read": 1,
    "report": 1,
    "role": "Accounts User"
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/pos_settings/pos_settings.json

@@ -51,6 +51,7 @@
   }
  ],
  "hide_toolbar": 0,
+ "icon": "settings",
  "issingle": 1,
  "links": [],
  "modified": "2026-03-16 13:28:19.677217",

erpnext/accounts/doctype/pricing_rule/pricing_rule.js

@@ -40,7 +40,7 @@ frappe.ui.form.on("Pricing Rule", {
 		var help_content = `<table class="table table-bordered" style="background-color: var(--scrollbar-track-color);">
 				<tr><td>
 					<h4>
-						<i class="fa fa-hand-right"></i>
+						<svg class="icon icon-sm"><use href="#icon-info"></use></svg>
 						${__("Notes")}
 					</h4>
 					<ul>
@@ -63,7 +63,7 @@ frappe.ui.form.on("Pricing Rule", {
 					</ul>
 				</td></tr>
 				<tr><td>
-					<h4><i class="fa fa-question-sign"></i>
+					<h4><svg class="icon icon-sm"><use href="#icon-circle-question-mark"></use></svg>
 						${__("How Pricing Rule is applied?")}
 					</h4>
 					<ol>
@@ -108,7 +108,7 @@ frappe.ui.form.on("Pricing Rule", {
 				</td></tr>
 			</table>`;
 
-		frm.set_df_property("pricing_rule_help", "options", help_content);
+		frm.get_field("pricing_rule_help").html(help_content);
 		frm.events.set_options_for_applicable_for(frm);
 		frm.trigger("toggle_reqd_apply_on");
 	},

erpnext/accounts/doctype/pricing_rule/pricing_rule.json

@@ -5,6 +5,7 @@
  "autoname": "naming_series:",
  "creation": "2014-02-21 15:02:51",
  "doctype": "DocType",
+ "documentation": "https://docs.frappe.io/erpnext/user/manual/en/pricing-rule",
  "engine": "InnoDB",
  "field_order": [
   "applicability_section",
@@ -654,7 +655,7 @@
    "label": "Don't Enforce Free Item Qty"
   }
  ],
- "icon": "fa fa-gift",
+ "icon": "badge-percent",
  "idx": 1,
  "links": [],
  "modified": "2026-02-17 12:24:07.553505",

erpnext/accounts/doctype/pricing_rule/pricing_rule.py

@@ -12,6 +12,29 @@ from frappe import _, throw
 from frappe.model.document import Document
 from frappe.utils import cint, flt
 
+# the transactions the pricing engine is called for, from transaction.js and the POS
+PRICING_TRANSACTION_DOCTYPES = frozenset(
+	{
+		"Quotation",
+		"Sales Order",
+		"Delivery Note",
+		"Sales Invoice",
+		"POS Invoice",
+		"Supplier Quotation",
+		"Purchase Order",
+		"Purchase Receipt",
+		"Purchase Invoice",
+		"Material Request",
+		# these three also extend a controller that calls the pricing engine: BOM and BOM Creator
+		# through TransactionController, Request for Quotation through BuyingController
+		"BOM",
+		"BOM Creator",
+		"Request for Quotation",
+		# no client sends this one, but set_transaction_type below still branches on it
+		"Opportunity",
+	}
+)
+
 apply_on_dict = {"Item Code": "items", "Item Group": "item_groups", "Brand": "brands"}
 
 other_fields = ["other_item_code", "other_item_group", "other_brand"]
@@ -364,6 +387,18 @@ def apply_pricing_rule(args, doc=None):
 
 	args = frappe._dict(args)
 
+	# The transaction being priced decides who may price it; doc= where the caller named one.
+	# An allow-list, not a type check: any readable doctype would otherwise satisfy has_permission.
+	transaction_doctype = args.get("doctype")
+	if transaction_doctype not in PRICING_TRANSACTION_DOCTYPES:
+		frappe.throw(_("Invalid doctype"), frappe.PermissionError)
+
+	transaction_name = args.get("name")
+	if not isinstance(transaction_name, str) or not frappe.db.exists(transaction_doctype, transaction_name):
+		transaction_name = None
+
+	frappe.has_permission(transaction_doctype, doc=transaction_name, throw=True)
+
 	set_transaction_type(args)
 
 	# list of dictionaries
@@ -389,6 +424,7 @@ def apply_pricing_rule(args, doc=None):
 	for item in item_list:
 		args_copy = copy.deepcopy(args)
 		args_copy.update(item)
+		set_transaction_type(args_copy)
 		data = get_pricing_rule_for_item(args_copy, doc=doc)
 		out.append(data)
 
@@ -722,14 +758,18 @@ def set_transaction_type(pricing_ctx: frappe._dict) -> None:
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_item_uoms(doctype, txt, searchfield, start, page_len, filters):
-	items = [filters.get("value")]
-	if filters.get("apply_on") != "Item Code":
-		field = frappe.scrub(filters.get("apply_on"))
-		items = [d.name for d in frappe.db.get_all("Item", filters={field: filters.get("value")})]
+	if filters.get("apply_on") == "Item Code":
+		item_filters = [["name", "=", filters.get("value")]]
+	else:
+		item_filters = [[frappe.scrub(filters.get("apply_on")), "=", filters.get("value")]]
+
+	items = frappe.get_list("Item", filters=item_filters, pluck="name")
+	if not items:
+		return []
 
 	return frappe.get_all(
 		"UOM Conversion Detail",
-		filters={"parent": ("in", items), "uom": ("like", f"{txt}%")},
+		filters={"parent": ("in", items), "parenttype": "Item", "uom": ("like", f"{txt}%")},
 		fields=["uom"],
 		as_list=1,
 		distinct=True,