Merge pull request #62555 from diptanilsaha/fix/party-report-company-permission

fix(accounts): apply user permissions in party balance reports

erpnext/accounts/report/customer_ledger_summary/customer_ledger_summary.py

@@ -14,6 +14,7 @@ from erpnext.accounts.doctype.accounting_dimension.accounting_dimension import (
 	get_accounting_dimensions,
 	get_dimension_with_children,
 )
+from erpnext.accounts.report.trial_balance.trial_balance import validate_company_permission
 
 TREE_DOCTYPES = frozenset(
 	["Customer Group", "Territory", "Supplier Group", "Sales Partner", "Sales Person", "Cost Center"]
@@ -49,6 +50,8 @@ class PartyLedgerSummaryReport:
 		if not self.filters.get("company"):
 			frappe.throw(_("{0} is mandatory").format(_("Company")))
 
+		validate_company_permission(self.filters.company)
+
 		if self.filters.from_date > self.filters.to_date:
 			frappe.throw(_("From Date must be before To Date"))
 
@@ -407,6 +410,11 @@ class PartyLedgerSummaryReport:
 							(gle[dimension.fieldname]).isin(self.filters.get(dimension.fieldname))
 						)
 
+		from frappe.desk.reportview import build_match_conditions
+
+		if match_conditions := build_match_conditions("GL Entry"):
+			query = query.where(Bracket(LiteralValue(match_conditions)))
+
 		return query
 
 	def get_return_invoices(self):

erpnext/accounts/report/customer_ledger_summary/test_customer_ledger_summary.py

@@ -427,3 +427,49 @@ class TestCustomerLedgerSummary(ERPNextTestSuite, AccountsTestMixin):
 			(row.opening_balance, row.invoiced_amount, row.paid_amount, row.closing_balance),
 			(700.0, 0.0, -300.0, 1000.0),
 		)
+
+	def test_company_without_permission_is_refused(self):
+		user = "test_cls_company_permission@example.com"
+		if not frappe.db.exists("User", user):
+			frappe.get_doc(
+				{"doctype": "User", "email": user, "first_name": "CLS", "roles": [{"role": "Accounts User"}]}
+			).insert()
+		frappe.permissions.add_user_permission("Company", "_Test Company 1", user)
+
+		frappe.set_user(user)
+		try:
+			self.assertRaises(
+				frappe.PermissionError,
+				execute,
+				{"company": self.company, "from_date": today(), "to_date": today()},
+			)
+		finally:
+			frappe.set_user("Administrator")
+
+	def test_amounts_follow_gl_entry_permissions(self):
+		from erpnext.accounts.doctype.account.test_account import create_account
+
+		other_receivable = create_account(
+			account_name="_Test CLS Receivable",
+			company=self.company,
+			parent_account="Accounts Receivable - _TC",
+			account_type="Receivable",
+		)
+		self.create_sales_invoice()
+		permitted_receivable, self.debit_to = self.debit_to, other_receivable
+		self.create_sales_invoice()
+
+		user = "test_cls_account_permission@example.com"
+		if not frappe.db.exists("User", user):
+			frappe.get_doc(
+				{"doctype": "User", "email": user, "first_name": "CLS", "roles": [{"role": "Accounts User"}]}
+			).insert()
+		frappe.permissions.add_user_permission("Account", permitted_receivable, user)
+
+		frappe.set_user(user)
+		try:
+			report = execute({"company": self.company, "from_date": today(), "to_date": today()})[1]
+		finally:
+			frappe.set_user("Administrator")
+
+		self.assertEqual([(row.party, row.invoiced_amount) for row in report], [(self.customer, 1000.0)])

erpnext/accounts/report/trial_balance_for_party/test_trial_balance_for_party.py

@@ -137,6 +137,49 @@ class TestTrialBalanceForParty(ERPNextTestSuite):
 		self.assertEqual({row["party"] for row in data[:-1]}, {"_Test Customer 1"})
 		self.assertEqual(data[-1]["debit"], 10000)
 
+	def test_company_without_permission_is_refused(self):
+		user = "test_tbp_company_permission@example.com"
+		if not frappe.db.exists("User", user):
+			frappe.get_doc(
+				{"doctype": "User", "email": user, "first_name": "TBP", "roles": [{"role": "Accounts User"}]}
+			).insert()
+		frappe.permissions.add_user_permission("Company", "_Test Company 1", user)
+
+		frappe.set_user(user)
+		try:
+			self.assertRaises(frappe.PermissionError, self.run_report)
+		finally:
+			frappe.set_user("Administrator")
+
+	def test_balances_follow_gl_entry_permissions(self):
+		from erpnext.accounts.doctype.account.test_account import create_account
+
+		other_receivable = create_account(
+			account_name="_Test TBP Receivable",
+			company="_Test Company",
+			parent_account="Accounts Receivable - _TC",
+			account_type="Receivable",
+		)
+		create_sales_invoice(customer="_Test Customer", qty=1, rate=10000, posting_date="2026-06-01")
+		create_sales_invoice(
+			customer="_Test Customer", qty=1, rate=6000, posting_date="2026-06-01", debit_to=other_receivable
+		)
+
+		user = "test_tbp_account_permission@example.com"
+		if not frappe.db.exists("User", user):
+			frappe.get_doc(
+				{"doctype": "User", "email": user, "first_name": "TBP", "roles": [{"role": "Accounts User"}]}
+			).insert()
+		frappe.permissions.add_user_permission("Account", "Debtors - _TC", user)
+
+		frappe.set_user(user)
+		try:
+			row = self.party_row("_Test Customer")
+		finally:
+			frappe.set_user("Administrator")
+
+		self.assertEqual(row["debit"], 10000)
+
 	def test_alternative_finance_book_entries_excluded(self):
 		customer = "_Test Customer"
 		create_sales_invoice(customer=customer, qty=1, rate=10000, posting_date="2026-06-01")

erpnext/accounts/report/trial_balance_for_party/trial_balance_for_party.py

@@ -4,16 +4,22 @@
 
 import frappe
 from frappe import _
+from frappe.desk.reportview import build_match_conditions
 from frappe.query_builder.functions import Sum
 from frappe.utils import cint, cstr, flt
+from pypika.terms import Bracket, LiteralValue
 
 from erpnext.accounts.report.general_ledger.general_ledger import get_accounts_with_children
-from erpnext.accounts.report.trial_balance.trial_balance import validate_filters
+from erpnext.accounts.report.trial_balance.trial_balance import (
+	validate_company_permission,
+	validate_filters,
+)
 from erpnext.accounts.utils import get_currency_precision
 from erpnext.stock.doctype.company_restriction.company_restriction import get_allowed_masters_condition
 
 
 def execute(filters=None):
+	validate_company_permission(filters.company)
 	validate_filters(filters)
 
 	show_party_name = is_party_name_visible(filters)
@@ -135,6 +141,9 @@ def get_opening_balances(filters, account_filter=None):
 	if finance_book_condition := get_finance_book_condition(GL_Entry, filters):
 		query = query.where(finance_book_condition)
 
+	if match_conditions := build_match_conditions("GL Entry"):
+		query = query.where(Bracket(LiteralValue(match_conditions)))
+
 	gle = query.run(as_dict=True)
 
 	opening = frappe._dict()
@@ -173,6 +182,9 @@ def get_balances_within_period(filters, account_filter=None):
 	if finance_book_condition := get_finance_book_condition(GL_Entry, filters):
 		query = query.where(finance_book_condition)
 
+	if match_conditions := build_match_conditions("GL Entry"):
+		query = query.where(Bracket(LiteralValue(match_conditions)))
+
 	gle = query.run(as_dict=True)
 
 	balances_within_period = frappe._dict()