Merge pull request #41440 from frappe/mergify/bp/version-14-hotfix/pr-41384

fix(SO, DN): only show permitted actions (backport #41384)

erpnext/public/js/controllers/transaction.js

@@ -265,7 +265,11 @@ erpnext.TransactionController = class TransactionController extends erpnext.taxe
 		}
 
 		const me = this;
-		if (!this.frm.is_new() && this.frm.doc.docstatus === 0) {
+		if (
+			!this.frm.is_new()
+			&& this.frm.doc.docstatus === 0
+			&& frappe.model.can_create("Quality Inspection")
+		) {
 			this.frm.add_custom_button(__("Quality Inspection(s)"), () => {
 				me.make_quality_inspection();
 			}, __("Create"));

erpnext/selling/doctype/sales_order/sales_order.js

@@ -48,8 +48,13 @@ frappe.ui.form.on("Sales Order", {
 		frm.set_df_property('packed_items', 'cannot_delete_rows', true);
 	},
 	refresh: function(frm) {
-		if(frm.doc.docstatus === 1 && frm.doc.status !== 'Closed'
-			&& flt(frm.doc.per_delivered, 6) < 100 && flt(frm.doc.per_billed, 6) < 100) {
+		if(
+			frm.doc.docstatus === 1
+			&& frm.doc.status !== "Closed"
+			&& flt(frm.doc.per_delivered, 6) < 100
+			&& flt(frm.doc.per_billed, 6) < 100
+			&& frm.has_perm("write")
+		) {
 			frm.add_custom_button(__('Update Items'), () => {
 				erpnext.utils.update_child_items({
 					frm: frm,
@@ -66,6 +71,10 @@ frappe.ui.form.on("Sales Order", {
 	},
 
 	get_items_from_internal_purchase_order(frm) {
+		if (!frappe.model.can_read("Purchase Order")) {
+			return;
+		}
+
 		frm.add_custom_button(__('Purchase Order'), () => {
 			erpnext.utils.map_current_doc({
 				method: 'erpnext.buying.doctype.purchase_order.purchase_order.make_inter_company_sales_order',
@@ -227,7 +236,11 @@ erpnext.selling.SalesOrderController = class SalesOrderController extends erpnex
 						}
 					}
 
-					if (flt(doc.per_picked, 6) < 100 && flt(doc.per_delivered, 6) < 100) {
+					if (
+						flt(doc.per_picked, 6) < 100
+						&& flt(doc.per_delivered, 6) < 100
+						&& frappe.model.can_create("Pick List")
+					) {
 						this.frm.add_custom_button(__('Pick List'), () => this.create_pick_list(), __('Create'));
 					}
 
@@ -237,45 +250,105 @@ erpnext.selling.SalesOrderController = class SalesOrderController extends erpnex
 					const order_is_a_custom_sale = ["Sales", "Shopping Cart", "Maintenance"].indexOf(doc.order_type) === -1;
 
 					// delivery note
-					if(flt(doc.per_delivered, 6) < 100 && (order_is_a_sale || order_is_a_custom_sale) && allow_delivery) {
-						this.frm.add_custom_button(__('Delivery Note'), () => this.make_delivery_note_based_on_delivery_date(), __('Create'));
-						this.frm.add_custom_button(__('Work Order'), () => this.make_work_order(), __('Create'));
+					if(
+						flt(doc.per_delivered, 6) < 100
+						&& (order_is_a_sale || order_is_a_custom_sale)
+						&& allow_delivery
+					) {
+						if (frappe.model.can_create("Delivery Note")) {
+							this.frm.add_custom_button(
+								__("Delivery Note"),
+								() => this.make_delivery_note_based_on_delivery_date(),
+								__("Create")
+							);
+						}
+						if (frappe.model.can_create("Work Order")) {
+							this.frm.add_custom_button(
+								__("Work Order"),
+								() => this.make_work_order(),
+								__("Create")
+							);
+						}
 					}
 
 					// sales invoice
-					if(flt(doc.per_billed, 6) < 100) {
-						this.frm.add_custom_button(__('Sales Invoice'), () => me.make_sales_invoice(), __('Create'));
+					if(flt(doc.per_billed, 6) < 100 && frappe.model.can_create("Sales Invoice")) {
+						this.frm.add_custom_button(
+							__("Sales Invoice"),
+							() => me.make_sales_invoice(),
+							__("Create")
+						);
 					}
 
 					// material request
-					if(!doc.order_type || (order_is_a_sale || order_is_a_custom_sale) && flt(doc.per_delivered, 6) < 100) {
-						this.frm.add_custom_button(__('Material Request'), () => this.make_material_request(), __('Create'));
-						this.frm.add_custom_button(__('Request for Raw Materials'), () => this.make_raw_material_request(), __('Create'));
+					if (
+						(
+							!doc.order_type
+							|| (order_is_a_sale || order_is_a_custom_sale)
+							&& flt(doc.per_delivered, 6) < 100
+						)
+						&& frappe.model.can_create("Material Request")
+					) {
+						this.frm.add_custom_button(
+							__('Material Request'),
+							() => this.make_material_request(),
+							__('Create')
+						);
+						this.frm.add_custom_button(
+							__('Request for Raw Materials'),
+							() => this.make_raw_material_request(),
+							__('Create')
+						);
 					}
 
 					// Make Purchase Order
-					if (!this.frm.doc.is_internal_customer) {
-						this.frm.add_custom_button(__('Purchase Order'), () => this.make_purchase_order(), __('Create'));
+					if (!this.frm.doc.is_internal_customer && frappe.model.can_create("Purchase Order")) {
+						this.frm.add_custom_button(
+							__('Purchase Order'),
+							() => this.make_purchase_order(),
+							__('Create')
+						);
 					}
 
 					// maintenance
 					if(flt(doc.per_delivered, 2) < 100 && (order_is_maintenance || order_is_a_custom_sale)) {
-						this.frm.add_custom_button(__('Maintenance Visit'), () => this.make_maintenance_visit(), __('Create'));
-						this.frm.add_custom_button(__('Maintenance Schedule'), () => this.make_maintenance_schedule(), __('Create'));
+						if(frappe.model.can_create("Maintenance Visit")) {
+							this.frm.add_custom_button(
+								__('Maintenance Visit'),
+								() => this.make_maintenance_visit(),
+								__('Create')
+							);
+						}
+
+						if(frappe.model.can_create("Maintenance Schedule")) {
+							this.frm.add_custom_button(
+								__('Maintenance Schedule'),
+								() => this.make_maintenance_schedule(),
+								__('Create')
+							);
+						}
 					}
 
 					// project
-					if(flt(doc.per_delivered, 2) < 100) {
+					if(flt(doc.per_delivered, 2) < 100 && frappe.model.can_create("Project")) {
 							this.frm.add_custom_button(__('Project'), () => this.make_project(), __('Create'));
 					}
 
-					if(!doc.auto_repeat) {
-						this.frm.add_custom_button(__('Subscription'), function() {
-							erpnext.utils.make_subscription(doc.doctype, doc.name)
-						}, __('Create'))
+					if(!doc.auto_repeat && frappe.model.can_create("Auto Repeat")) {
+						this.frm.add_custom_button(
+							__('Subscription'),
+							function() {
+								erpnext.utils.make_subscription(doc.doctype, doc.name)
+							},
+							__('Create')
+						);
 					}
 
-					if (doc.docstatus === 1 && !doc.inter_company_order_reference) {
+					if (
+						doc.docstatus === 1 &&
+						!doc.inter_company_order_reference &&
+						frappe.model.can_create("Purchase Order")
+					) {
 						let me = this;
 						let internal = me.frm.doc.is_internal_customer;
 						if (internal) {
@@ -290,14 +363,25 @@ erpnext.selling.SalesOrderController = class SalesOrderController extends erpnex
 				}
 				// payment request
 				if(flt(doc.per_billed, precision('per_billed', doc)) < 100 + frappe.boot.sysdefaults.over_billing_allowance) {
-					this.frm.add_custom_button(__('Payment Request'), () => this.make_payment_request(), __('Create'));
-					this.frm.add_custom_button(__('Payment'), () => this.make_payment_entry(), __('Create'));
+					this.frm.add_custom_button(
+						__("Payment Request"),
+						() => this.make_payment_request(),
+						__("Create")
+					);
+
+					if (frappe.model.can_create("Payment Entry")) {
+						this.frm.add_custom_button(
+							__("Payment"),
+							() => this.make_payment_entry(),
+							__("Create")
+						);
+					}
 				}
 				this.frm.page.set_inner_btn_group_as_primary(__('Create'));
 			}
 		}
 
-		if (this.frm.doc.docstatus===0) {
+		if (this.frm.doc.docstatus===0 && frappe.model.can_read("Quotation")) {
 			this.frm.add_custom_button(__('Quotation'),
 				function() {
 					let d = erpnext.utils.map_current_doc({

erpnext/stock/doctype/delivery_note/delivery_note.js

@@ -86,7 +86,7 @@ frappe.ui.form.on("Delivery Note", {
 	},
 
 	refresh: function(frm) {
-		if (frm.doc.docstatus === 1 && frm.doc.is_return === 1 && frm.doc.per_billed !== 100) {
+		if (frm.doc.docstatus === 1 && frm.doc.is_return === 1 && frm.doc.per_billed !== 100 && frappe.model.can_create("Sales Invoice")) {
 			frm.add_custom_button(__('Credit Note'), function() {
 				frappe.model.open_mapped_doc({
 					method: "erpnext.stock.doctype.delivery_note.delivery_note.make_sales_invoice",
@@ -96,7 +96,11 @@ frappe.ui.form.on("Delivery Note", {
 			frm.page.set_inner_btn_group_as_primary(__('Create'));
 		}
 
-		if (frm.doc.docstatus == 1 && !frm.doc.inter_company_reference) {
+		if (
+			frm.doc.docstatus == 1 &&
+			!frm.doc.inter_company_reference &&
+			frappe.model.can_create("Purchase Receipt")
+		) {
 			let internal = frm.doc.is_internal_customer;
 			if (internal) {
 				let button_label = (frm.doc.company === frm.doc.represents_company) ? "Internal Purchase Receipt" :
@@ -135,64 +139,88 @@ erpnext.stock.DeliveryNoteController = class DeliveryNoteController extends erpn
 	refresh(doc, dt, dn) {
 		var me = this;
 		super.refresh();
-		if ((!doc.is_return) && (doc.status!="Closed" || this.frm.is_new())) {
-			if (this.frm.doc.docstatus===0) {
-				this.frm.add_custom_button(__('Sales Order'),
-					function() {
-						if (!me.frm.doc.customer) {
-							frappe.throw({
-								title: __("Mandatory"),
-								message: __("Please Select a Customer")
-							});
+		if (
+			!doc.is_return
+			&& (doc.status!="Closed" || this.frm.is_new())
+			&& this.frm.has_perm("write")
+			&& frappe.model.can_read("Sales Order")
+			&& this.frm.doc.docstatus===0
+		) {
+			this.frm.add_custom_button(
+				__('Sales Order'),
+				function() {
+					if (!me.frm.doc.customer) {
+						frappe.throw({
+							title: __("Mandatory"),
+							message: __("Please Select a Customer")
+						});
+					}
+					erpnext.utils.map_current_doc({
+						method: "erpnext.selling.doctype.sales_order.sales_order.make_delivery_note",
+						source_doctype: "Sales Order",
+						target: me.frm,
+						setters: {
+							customer: me.frm.doc.customer,
+						},
+						get_query_filters: {
+							docstatus: 1,
+							status: ["not in", ["Closed", "On Hold"]],
+							per_delivered: ["<", 99.99],
+							company: me.frm.doc.company,
+							project: me.frm.doc.project || undefined,
 						}
-						erpnext.utils.map_current_doc({
-							method: "erpnext.selling.doctype.sales_order.sales_order.make_delivery_note",
-							source_doctype: "Sales Order",
-							target: me.frm,
-							setters: {
-								customer: me.frm.doc.customer,
-							},
-							get_query_filters: {
-								docstatus: 1,
-								status: ["not in", ["Closed", "On Hold"]],
-								per_delivered: ["<", 99.99],
-								company: me.frm.doc.company,
-								project: me.frm.doc.project || undefined,
-							}
-						})
-					}, __("Get Items From"));
-			}
+					})
+				},
+				__("Get Items From")
+			);
 		}
 
 		if (!doc.is_return && doc.status!="Closed") {
-			if(doc.docstatus == 1) {
+			if (doc.docstatus == 1 && frappe.model.can_create("Shipment")) {
 				this.frm.add_custom_button(__('Shipment'), function() {
 					me.make_shipment() }, __('Create'));
 			}
 
-			if(flt(doc.per_installed, 2) < 100 && doc.docstatus==1)
-				this.frm.add_custom_button(__('Installation Note'), function() {
-					me.make_installation_note() }, __('Create'));
+			if (
+				flt(doc.per_installed, 2) < 100
+				&& doc.docstatus==1
+				&& frappe.model.can_create("Installation Note")
+			) {
+				this.frm.add_custom_button(
+					__('Installation Note'),
+					function() {
+						me.make_installation_note()
+					},
+					__('Create')
+				);
+			}
 
-			if (doc.docstatus==1) {
+			if (doc.docstatus==1 && this.frm.has_perm("create")) {
 				this.frm.add_custom_button(__('Sales Return'), function() {
 					me.make_sales_return() }, __('Create'));
 			}
 
-			if (doc.docstatus==1) {
+			if (doc.docstatus==1 && frappe.model.can_create("Delivery Trip")) {
 				this.frm.add_custom_button(__('Delivery Trip'), function() {
 					me.make_delivery_trip() }, __('Create'));
 			}
 
-			if(doc.docstatus==0 && !doc.__islocal) {
-				if (doc.__onload && doc.__onload.has_unpacked_items) {
-					this.frm.add_custom_button(__('Packing Slip'), function() {
+			if (
+				doc.docstatus==0
+				&& !doc.__islocal
+				&& frappe.model.can_create("Packing Slip")
+				&& (doc.__onload && doc.__onload.has_unpacked_items)
+			) {
+				this.frm.add_custom_button(
+					__('Packing Slip'),
+					function() {
 						frappe.model.open_mapped_doc({
 							method: "erpnext.stock.doctype.delivery_note.delivery_note.make_packing_slip",
 							frm: me.frm
-						}) }, __('Create')
-					);
-				}
+						});
+					},
+					__('Create')
+				);
 			}
 
 			if (!doc.__islocal && doc.docstatus==1) {
@@ -211,7 +239,13 @@ erpnext.stock.DeliveryNoteController = class DeliveryNoteController extends erpn
 			}
 		}
 
-		if(doc.docstatus==1 && !doc.is_return && doc.status!="Closed" && flt(doc.per_billed) < 100) {
+		if(
+			doc.docstatus==1
+			&& !doc.is_return
+			&& doc.status!="Closed"
+			&& flt(doc.per_billed) < 100
+			&& frappe.model.can_create("Sales Invoice")
+		) {
 			// show Make Invoice button only if Delivery Note is not created from Sales Invoice
 			var from_sales_invoice = false;
 			from_sales_invoice = me.frm.doc.items.some(function(item) {
@@ -230,7 +264,12 @@ erpnext.stock.DeliveryNoteController = class DeliveryNoteController extends erpn
 		}
 		erpnext.stock.delivery_note.set_print_hide(doc, dt, dn);
 
-		if(doc.docstatus==1 && !doc.is_return && !doc.auto_repeat) {
+		if(
+			doc.docstatus==1
+			&& !doc.is_return
+			&& !doc.auto_repeat
+			&& frappe.model.can_create("Auto Repeat")
+		) {
 			cur_frm.add_custom_button(__('Subscription'), function() {
 				erpnext.utils.make_subscription(doc.doctype, doc.name)
 			}, __('Create'))