@multiplatform.one/backoffice 7.28.1 → 7.29.1

package/src/i18n/en.ts

@@ -272,6 +272,7 @@ export const en = {
     executionTime: "ran in {{seconds}}s",
     filtersRequiredDescription: "Set the required filter(s) to run this report: {{filters}}",
     filtersRequiredTitle: "Filters required",
+    notPermitted: 'You can\'t run "{{report}}"',
     refresh: "Refresh",
     retry: "Retry",
     rowCount: "{{count}} row(s)",

package/src/list/ListBulkActionsBar.rights.spec.tsx

@@ -0,0 +1,134 @@
+// The bulk actions bar offers Bulk Edit / Submit / Cancel / Delete only as
+// far as the session's roles grant them on the doctype (MPO-428), measured
+// against a live-shaped bench: the session RPCs for the user and roles, with
+// meta (and its DocPerm rows) passed in as a prop, so the bar never asks for
+// meta itself.
+import { renderWithProviders } from "@multiplatform.one/test-utils";
+import { act, screen, waitFor, within } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { BackofficeProvider } from "../config/BackofficeProvider";
+import { createMemoryNavigator } from "../navigation/navigator";
+import type { DoctypeMeta } from "../shared/useDoctypeMeta";
+import { ListBulkActionsBar } from "./ListBulkActionsBar";
+
+const doctype = "QA Submittable";
+
+const meta: DoctypeMeta = {
+  name: doctype,
+  is_submittable: 1,
+  fields: [{ fieldname: "subject", fieldtype: "Data", label: "Subject" }],
+  permissions: [
+    {
+      role: "Pokemon Editor",
+      read: 1,
+      write: 1,
+      create: 1,
+      delete: 1,
+      submit: 1,
+      cancel: 1,
+    },
+    { role: "Pokemon Writer", read: 1, write: 1, create: 1 },
+    { role: "Guest", read: 1 },
+  ],
+};
+
+let run = 0;
+let roles: string[] = [];
+let sessionAnswered = false;
+let requested: string[] = [];
+
+function json(body: unknown, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+beforeEach(() => {
+  run += 1;
+  sessionAnswered = false;
+  requested = [];
+  vi.stubGlobal("fetch", async (input: string | URL | Request) => {
+    const url = new URL(String(input instanceof Request ? input.url : input));
+    const method = url.pathname.replace(/^\/api\/method\//, "");
+    requested.push(method);
+    if (method === "frappe.auth.get_logged_user") return json({ message: "user@pokemon.test" });
+    if (method === "frappe.core.doctype.user.user.get_roles") {
+      sessionAnswered = true;
+      return json({ message: roles });
+    }
+    return json({ data: [], message: [] });
+  });
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+function renderBar(barMeta: DoctypeMeta = meta) {
+  return renderWithProviders(
+    <BackofficeProvider
+      frappe={{ baseURL: `https://list-bulk-rights-${run}.spec.test` }}
+      navigation={createMemoryNavigator("/backoffice")}
+    >
+      <ListBulkActionsBar
+        doctype={barMeta.name}
+        meta={barMeta}
+        selectedNames={["SUB-001", "SUB-002"]}
+        onClearSelection={() => {}}
+        onActionComplete={() => {}}
+      />
+    </BackofficeProvider>,
+  );
+}
+
+async function settle() {
+  await waitFor(() => expect(sessionAnswered).toBe(true));
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  });
+}
+
+function writeActionLabels(): string[] {
+  const root = within(document.body);
+  return ["Bulk Edit", "Submit", "Cancel", "Delete"].filter(
+    (label) => root.queryByRole("button", { name: label }) !== null,
+  );
+}
+
+describe("ListBulkActionsBar rights", () => {
+  it("offers an editor Bulk Edit, Submit, Cancel and Delete", async () => {
+    roles = ["Pokemon Editor", "Guest"];
+    renderBar();
+    await settle();
+    await waitFor(() =>
+      expect(writeActionLabels()).toEqual(["Bulk Edit", "Submit", "Cancel", "Delete"]),
+    );
+    expect(screen.getByText("2 selected")).toBeTruthy();
+    expect(requested.filter((method) => method.includes("getdoctype"))).toEqual([]);
+  });
+
+  it("offers a writer without delete Bulk Edit alone", async () => {
+    roles = ["Pokemon Writer", "Guest"];
+    renderBar();
+    await settle();
+    await waitFor(() => expect(writeActionLabels()).toEqual(["Bulk Edit"]));
+  });
+
+  it("keeps Submit and Cancel off a doctype that isn't submittable, even for an editor", async () => {
+    roles = ["Pokemon Editor", "Guest"];
+    renderBar({ ...meta, name: "QA Plain", is_submittable: 0 });
+    await settle();
+    await waitFor(() => expect(writeActionLabels()).toEqual(["Bulk Edit", "Delete"]));
+  });
+
+  it("offers a reader none of Bulk Edit, Submit, Cancel or Delete", async () => {
+    roles = ["Guest"];
+    renderBar();
+    await settle();
+    expect(writeActionLabels()).toEqual([]);
+    expect(screen.getByText("2 selected")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Export CSV" })).toBeTruthy();
+  });
+});

package/src/list/ListBulkActionsBar.screen.spec.tsx

@@ -1,6 +1,9 @@
 // ListBulkActionsBar over a selection (MPO-414): the bar's gates, its
 // confirm-guarded delete and docstatus RPCs, the Bulk Edit dialog it opens,
 // and the host list actions it offers for the doctype on screen.
+// Fixture mode withholds no session rights (MPO-428); reader/editor coverage
+// lives in ListBulkActionsBar.rights.spec.tsx.
+import { InMemoryFixtureProvider } from "@multiplatform.one/frappe";
 import { renderWithProviders } from "@multiplatform.one/test-utils";
 import { fireEvent, screen, waitFor, within } from "@testing-library/react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -72,7 +75,10 @@ function renderBar({
   const onActionComplete = vi.fn();
   const view = renderWithProviders(
     <BackofficeProvider
-      frappe={{ baseURL: `https://list-bulk-${run}.spec.test` }}
+      frappe={{
+        baseURL: `https://list-bulk-${run}.spec.test`,
+        fixtures: new InMemoryFixtureProvider({}),
+      }}
       navigation={createMemoryNavigator("/backoffice/ToDo")}
       capabilities={capabilities}
       actions={actions}

package/src/list/ListBulkActionsBar.tsx

@@ -6,13 +6,13 @@
 // DataTable's built-in selection toolbar (house DG-TBL-02 pattern) using
 // the shared dialogs/helpers below; this standalone bar exists for surfaces
 // that manage selection themselves (report/kanban streams).
-import React from "react";
+import React, { useMemo, useState } from "react";
 import { ConfirmDialog, Text, XStack, notify } from "@multiplatform.one/components";
 // Catalog action Button — `error` renders the destructive intent from the
 // semantic ramp instead of a hardcoded named hue (LC-05 ONE-EMPHASIS).
 import { Button } from "@multiplatform.one/forms";
+import { sessionDocRights, useFrappeConfig } from "@multiplatform.one/frappe-ui";
 import { useResolvedKnobs } from "@multiplatform.one/theme";
-import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
   actionsForDoctype,
@@ -22,6 +22,7 @@ import {
 import { BACKOFFICE_I18N_NAMESPACE } from "../i18n";
 import type { DoctypeMeta } from "../shared/useDoctypeMeta";
 import { useFrappeApp } from "../shared/useFrappeApp";
+import { useUserRoles } from "../shared/useUserRoles";
 import { AddTagsDialog } from "./AddTagsDialog";
 import { AssignToDialog } from "./AssignToDialog";
 import { bulkDelete } from "./bulkActions";
@@ -51,6 +52,16 @@ export function ListBulkActionsBar({
   const app = useFrappeApp();
   const capabilities = useBackofficeCapabilities();
   const { actions } = useBackofficeConfig();
+  const config = useFrappeConfig();
+  const fixtureMode = Boolean(config?.fixtures);
+  // Session roles × meta.permissions: write/submit/cancel/delete bulk actions
+  // follow the doctype's DocPerm rows (DoctypeListScreen / MPO-390). Fixture
+  // mode has no session and withholds nothing.
+  const { roles, user: rolesUser } = useUserRoles();
+  const rights = useMemo(
+    () => sessionDocRights({ fixtures: fixtureMode, meta, roles, user: rolesUser }),
+    [fixtureMode, meta, roles, rolesUser],
+  );
   const [confirmDelete, setConfirmDelete] = useState(false);
   const [assignOpen, setAssignOpen] = useState(false);
   const [tagOpen, setTagOpen] = useState(false);
@@ -222,9 +233,11 @@ export function ListBulkActionsBar({
           count: selectedNames.length,
         })}
       </Text>
-      <Button size={knobProps.sizeToken} onPress={() => setEditOpen(true)}>
-        {t("list.editTitle", "Bulk Edit")}
-      </Button>
+      {rights.write && (
+        <Button size={knobProps.sizeToken} onPress={() => setEditOpen(true)}>
+          {t("list.editTitle", "Bulk Edit")}
+        </Button>
+      )}
       <Button
         size={knobProps.sizeToken}
         disabled={exporting}
@@ -253,53 +266,57 @@ export function ListBulkActionsBar({
           {action.label}
         </Button>
       ))}
-      {isSubmittable && (
-        <>
-          <Button
-            size={knobProps.sizeToken}
-            disabled={docstatusBusy}
-            onPress={() => setDocstatusAction("submit")}
-          >
-            {t("list.submit", "Submit")}
-          </Button>
-          <Button
-            size={knobProps.sizeToken}
-            disabled={docstatusBusy}
-            onPress={() => setDocstatusAction("cancel")}
-          >
-            {t("list.cancel", "Cancel")}
-          </Button>
-        </>
+      {isSubmittable && rights.submit && (
+        <Button
+          size={knobProps.sizeToken}
+          disabled={docstatusBusy}
+          onPress={() => setDocstatusAction("submit")}
+        >
+          {t("list.submit", "Submit")}
+        </Button>
+      )}
+      {isSubmittable && rights.cancel && (
+        <Button
+          size={knobProps.sizeToken}
+          disabled={docstatusBusy}
+          onPress={() => setDocstatusAction("cancel")}
+        >
+          {t("list.cancel", "Cancel")}
+        </Button>
       )}
       {/* Busy is derived state — `loading` shows the spinner and skips the
           DG-ST-03 bare-disabled guardrail (catalog Toolbar precedent). */}
-      <Button
-        size={knobProps.sizeToken}
-        error
-        loading={deleting}
-        onPress={() => setConfirmDelete(true)}
-      >
-        {t("list.delete", "Delete")}
-      </Button>
+      {rights.delete && (
+        <Button
+          size={knobProps.sizeToken}
+          error
+          loading={deleting}
+          onPress={() => setConfirmDelete(true)}
+        >
+          {t("list.delete", "Delete")}
+        </Button>
+      )}
       <Button size={knobProps.sizeToken} chromeless onPress={onClearSelection}>
         {t("list.clearSelection", "Clear selection")}
       </Button>
 
-      <ConfirmDialog
-        open={confirmDelete}
-        onOpenChange={setConfirmDelete}
-        destructive
-        title={t("list.deleteTitle", "Delete documents")}
-        body={t("list.deleteBody", {
-          defaultValue: "Permanently delete {{count}} {{doctype}} document(s)?",
-          count: selectedNames.length,
-          doctype,
-        })}
-        confirmLabel={t("list.delete", "Delete")}
-        onConfirm={() => {
-          void handleDelete();
-        }}
-      />
+      {rights.delete && (
+        <ConfirmDialog
+          open={confirmDelete}
+          onOpenChange={setConfirmDelete}
+          destructive
+          title={t("list.deleteTitle", "Delete documents")}
+          body={t("list.deleteBody", {
+            defaultValue: "Permanently delete {{count}} {{doctype}} document(s)?",
+            count: selectedNames.length,
+            doctype,
+          })}
+          confirmLabel={t("list.delete", "Delete")}
+          onConfirm={() => {
+            void handleDelete();
+          }}
+        />
+      )}
       {showAssign && (
         <AssignToDialog
           doctype={doctype}
@@ -324,18 +341,20 @@ export function ListBulkActionsBar({
           }}
         />
       )}
-      <BulkEditDialog
-        doctype={doctype}
-        meta={meta}
-        names={selectedNames}
-        open={editOpen}
-        onOpenChange={setEditOpen}
-        onDone={() => {
-          onClearSelection();
-          onActionComplete();
-        }}
-      />
-      {isSubmittable && (
+      {rights.write && (
+        <BulkEditDialog
+          doctype={doctype}
+          meta={meta}
+          names={selectedNames}
+          open={editOpen}
+          onOpenChange={setEditOpen}
+          onDone={() => {
+            onClearSelection();
+            onActionComplete();
+          }}
+        />
+      )}
+      {isSubmittable && (rights.submit || rights.cancel) && (
         <ConfirmDialog
           open={docstatusAction !== undefined}
           onOpenChange={(open) => {

package/src/list/ListFilterBar.screen.spec.tsx

@@ -29,7 +29,7 @@ const todoMeta: DoctypeMeta = {
 };
 
 let run = 0;
-let requests: URL[] = [];
+let savedFiltersRead: Promise<URL>;
 
 function json(body: unknown, status = 200) {
   return new Response(JSON.stringify(body), {
@@ -40,10 +40,18 @@ function json(body: unknown, status = 200) {
 
 beforeEach(() => {
   run += 1;
-  requests = [];
+  let markSavedFiltersRead: (url: URL) => void = () => {};
+  savedFiltersRead = new Promise((resolve) => {
+    markSavedFiltersRead = resolve;
+  });
   vi.stubGlobal("fetch", async (input: string | URL | Request) => {
     const url = new URL(String(input instanceof Request ? input.url : input));
-    requests.push(url);
+    if (
+      url.pathname.endsWith("frappe.client.get_list") &&
+      url.searchParams.get("doctype") === "List Filter"
+    ) {
+      markSavedFiltersRead(url);
+    }
     if (url.pathname.endsWith("frappe.auth.get_logged_user")) {
       return json({ message: "jane@example.com" });
     }
@@ -153,16 +161,9 @@ describe("ListFilterBar", () => {
 
   it("reads the doctype's saved filters and offers Save Filter only while filters apply", async () => {
     renderBar();
-    await waitFor(() =>
-      expect(
-        requests.some(
-          (url) =>
-            url.pathname.endsWith("frappe.client.get_list") &&
-            url.searchParams.get("doctype") === "List Filter" &&
-            url.searchParams.get("filters") ===
-              JSON.stringify([["reference_doctype", "=", "ToDo"]]),
-        ),
-      ).toBe(true),
+    const read = await savedFiltersRead;
+    expect(read.searchParams.get("filters")).toBe(
+      JSON.stringify([["reference_doctype", "=", "ToDo"]]),
     );
     expect(screen.queryByRole("button", { name: /save filter/i })).toBeNull();
   });

package/src/list/sidebar-section.tsx

@@ -11,6 +11,7 @@ import {
   Skeleton,
   XStack,
   YStack,
+  useAccordionTriggerInk,
 } from "@multiplatform.one/components";
 import {
   GroupPositionContext,
@@ -34,6 +35,15 @@ export interface SidebarSectionProps {
   children: ReactNode;
 }
 
+function SidebarSectionTitle({ title }: { title: string }) {
+  const color = useAccordionTriggerInk("$color11");
+  return (
+    <SizableText size="$2" fontWeight="400" color={color as never} numberOfLines={1} flexShrink={1}>
+      {title}
+    </SizableText>
+  );
+}
+
 /** Trigger + facet stack. ListSidebar wraps this in Accordion.Item so the
  *  Accordion root can count items (a custom Item wrapper is opaque). */
 export function SidebarSectionChrome({ title, children }: Omit<SidebarSectionProps, "value">) {
@@ -41,9 +51,7 @@ export function SidebarSectionChrome({ title, children }: Omit<SidebarSectionPro
   return (
     <>
       <Accordion.Trigger minHeight="$4" paddingVertical="$1.5" paddingHorizontal="$2">
-        <SizableText size="$2" fontWeight="400" color="$color11" numberOfLines={1} flexShrink={1}>
-          {title}
-        </SizableText>
+        <SidebarSectionTitle title={title} />
       </Accordion.Trigger>
       <Accordion.Content padding={0}>
         <YStack>