feat: secure inbound purchase invoice actions

enuxia_einvoice/permissions.py

@@ -167,3 +167,21 @@ def require_sales_invoice_access(
     require_company_access(
         invoice.company
     )
+
+
+def require_purchase_invoice_create_access() -> None:
+    """Vérifier le droit ERPNext de créer une facture d'achat."""
+
+    if frappe.has_permission(
+        "Purchase Invoice",
+        ptype="create",
+    ):
+        return
+
+    frappe.throw(
+        frappe._(
+            "Vous n’êtes pas autorisé à créer "
+            "une facture d’achat."
+        ),
+        frappe.PermissionError,
+    )

enuxia_einvoice/purchase_calculation.py

@@ -9,6 +9,11 @@ from typing import Any
 import frappe
 from frappe import _
 
+from enuxia_einvoice.permissions import (
+    require_exchange_access,
+    require_purchase_invoice_create_access,
+)
+
 from enuxia_einvoice.purchase_dates import (
     require_purchase_posting_date,
 )
@@ -765,7 +770,10 @@ def calculate_purchase_invoice_in_memory(
         exchange_name,
     )
 
-    exchange.check_permission("read")
+    require_exchange_access(
+        exchange
+    )
+    require_purchase_invoice_create_access()
 
     if exchange.direction != "Inbound":
         frappe.throw(

enuxia_einvoice/purchase_documents.py

@@ -9,6 +9,8 @@ from urllib.parse import unquote, urlsplit
 import frappe
 from frappe import _
 
+from enuxia_einvoice.permissions import require_exchange_access
+
 
 ALLOWED_FILE_PREFIXES = (
     "/files/",
@@ -171,7 +173,9 @@ def get_purchase_invoice_documents(
         exchange_name,
     )
 
-    exchange.check_permission("read")
+    require_exchange_access(
+        exchange
+    )
 
     _validate_bidirectional_link(
         invoice,

enuxia_einvoice/purchase_preview.py

@@ -10,6 +10,8 @@ from typing import Any
 import frappe
 from frappe import _
 
+from enuxia_einvoice.permissions import require_purchase_invoice_create_access
+
 from enuxia_einvoice.permissions import (
     require_exchange_access,
 )
@@ -595,7 +597,10 @@ def preview_purchase_invoice(
         exchange_name,
     )
 
-    exchange.check_permission("read")
+    require_exchange_access(
+        exchange
+    )
+    require_purchase_invoice_create_access()
 
     if exchange.direction != "Inbound":
         frappe.throw(