Doctype Permission

This app is the answer to the topic Design of User Permissions is Dangerous, where data is grant first and then add more restriction later.

Install Doctype Permission

bench get-app https://github.com/ecosoft-frappe/doctype_permission

Add the Frappe Gems badge to your README

Maintain Doctype Permission? Paste this into your README:

[![Listed on Frappe Gems](https://frappegems.com/api/method/frappe_gems.seo.badge?app=ecosoft-frappe%2Fdoctype_permission)](https://frappegems.com/gems/apps/ecosoft-frappe/doctype_permission)

About Doctype Permission

DocType Permission

This app is the answer to the topic Design of User Permissions is Dangerous, where data is grant first and then add more restriction later.

The DocType Permission is the opposite, it allow system admin to restrict first, and then grant more permission later.

Behind the scene, it is using permissionqueryconditions and has_permission in hooks.py and so, it works as additional security measurement with existing User Permission and Permission query.

Key DocTypes:

  1. DocType Permission, a submittable document that restrict and then grant different permission to different role
  2. DocType Permission Level, master data for pre-built permission query script

Benefit:

  • Intuitive and easy to us. Restrict first permit later.
  • Can work along side with standard user permissions, permission queries.

Problem with Current System:

Given example of a sensitive document such as Salary Slip.

  • Employees to see only his/her own Salary Slip
  • Payroll Users to see all Salary Slips

Without this app, following setup is required.

  • For Employees, create each User Permission for each employee. If there are 1,000 employees then 1,000 User Permissions is required.
  • For Payroll Users, make sure there is no User Permissions created for them.

As you can see it is now difficult to keep track of the amount of User Permissions. And if for some reason either system or human, a User Permission is missing for someone, this can be a very serious data breach!

Solution with DocType Permission:

Given the same example, no 1,000 User Pemissions is needed, just create 1 DocType Permission as following,

doctype_permission

As soon as this document is created for Salary Slip, all documents will be restrictred. And then by adding each Role’s Additional Permission, the permission will be granted (using OR condition).

Notes:

  • The combined SQL condition would be, (false OR Role-1 OR Role-2)
  • This consition will then be AND with other SQL condition from User Permissiona and/or Permission Query (if used)
  • DocType Prmission Level are canned permission query which can be exteded by ourself

doctype_permission_level

License

MIT

Related HR & Payroll apps for Frappe & ERPNext

  • Hrms — Open Source HR and Payroll Software
  • Huf — Open-source, self-hosted multi-agent AI infrastructure for teams and apps with support for cloud and local models, tool integrations, workflows, and automation across business systems including Slack, ERPNext, Discord & Gmail.
  • Bookings — Hotel Management App for Erpnext
  • Employee Self Service — This is the backend component for Nesscale ESS - a mobile app that brings ERPNext to your phone. Employees can manage their HR tasks, sales activities, and projects right from their mobile devices.
  • Inventory Tools — A collection of features to streamline and enhance inventory management and manufacturing workflows in ERPNext.
  • Check Run — Payables utility for ERPNext
  • Next Ai — NextAI is an AI-powered app for Frappe and ERPNext, delivering seamless content generation, automation, and productivity enhancements.
  • Projectit — Open Source PWA mobile app to track the Employees out in the field. This mobile app is developed on Frappe Framework and it is integrated with the Project functionalities of ERPNext and integrated tightly with Frappe HR.