fix: skip permission checks in reference details when ignore_permissions is set (backport)
Production symptom
On v5-fix sites (hrms v3.14.1), Stancer card payments made from the portal against a Sales Invoice are never booked. When the Customer user comes back from the gateway, PaymentRequest.create_payment_entry sets frappe.flags.ignore_permissions. But the HRMS override hrms/overrides/employee_payment_entry.py:get_payment_reference_details (and get_reference_details_for_employee) calls frappe.has_permission(..., throw=True) regardless of that flag. This check was added by upstream commit 1a3f8acc, "fix: permission check for whitelisted methods". The portal user has no desk read permission on the Sales Invoice, so a PermissionError is raised and the Payment Entry is never created.
We saw this on village-lepuy-en-velay on 19/08, 23/08 and 04/09.
ERPNext's own get_reference_details already skips the check with if not frappe.flags.ignore_permissions.
Change
This backports two commits from develop:
- d3a61bcb "fix: skip permission checks in reference details when ignore_permissions is set": only calls
frappe.has_permissionwhenfrappe.flags.ignore_permissionsis not set, in both functions. - fc7a875a "test: guard the ignore_permissions bypass in payment reference details": adds the
TestReferenceDetailsIgnorePermissionsDokosregression tests and their catalog entry tohrms/tests/test_dokos_specificities.py.
The test cherry-pick conflicted because v5-fix's test_dokos_specificities.py is different from develop's. I resolved it by keeping all v5-fix content and adding only the Payment Entry catalog entry and the new test class. The Attendance calendar block from develop was left out because it is not part of this fix. ruff-format also rewrapped two lines to match v5-fix's formatting.
Testing
The tests were not run locally, because no local bench is on v5-fix. I only ran static checks: py_compile passes, and ruff check / ruff format --check are clean on both changed files.