Skip to content

fix(checkout): guest order still fails with PermissionError on live - #7

Merged
Sakib-invento merged 1 commit into
version-16from
develop
Oct 12, 2026
Merged

Sakib-invento merged 1 commit into
version-16from
develop

Conversation

@Sakib-invento

Copy link
Copy Markdown
Collaborator

Summary

  • 1.1.2 set quotation.flags.ignore_permissions, but that only covers permission checks on the Quotation document itself.
  • The actual failure, confirmed via a full traceback captured directly on production (ERPNext 16.35.0), is erpnext.stock.get_item_details.get_item_details() calling item.check_permission() on a separate Item document - a check that flag never reaches. Dev runs an older ERPNext (16.19.1) without that check, which is why it never reproduced there.
  • place_order() now runs quotation building, pricing/tax calculation and submission under a temporary Administrator elevation (_run_as_system_user()), restored to the real session user immediately after. Checkout no longer depends on which Item (or other business doctype) permissions happen to be configured for a customer's role on a given site.

Release 1.1.3.

Test plan

  • Reproduced the exact live traceback via bench console on the production site itself (same account that failed in the browser), confirming item.check_permission() in get_item_details.py as the failure point.
  • Verified locally end-to-end with the fix: guest signup + order succeeds, Portal User row is created, and the session correctly restores to the real customer (not stuck as Administrator) once the elevated block exits.

1.1.2 set quotation.flags.ignore_permissions, but that only covers
permission checks on the Quotation document itself. The actual failure,
confirmed via a full traceback on production (ERPNext 16.35.0), is
erpnext.stock.get_item_details.get_item_details() calling
item.check_permission() directly on a separate Item document - a check
that flag never reaches. Dev runs an older ERPNext (16.19.1) without
that check, which is why it never reproduced there.

place_order() now runs quotation building, pricing/tax calculation and
submission under a temporary Administrator elevation
(_run_as_system_user()), restored to the real session user immediately
after (verified: session is back to the customer, not stuck elevated,
once the block exits). Checkout no longer depends on which Item (or
other business doctype) permissions happen to be configured for a
customer's role on a given site.

Release 1.1.3.
@Sakib-invento
Sakib-invento merged commit f5575af into version-16 Oct 12, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant