feat: enforce electronic invoicing operator access

enuxia_einvoice/conversion.py

@@ -10,6 +10,8 @@ from xml.etree import ElementTree
 
 import frappe
 from frappe import _
+
+from enuxia_einvoice.permissions import require_sales_invoice_access
 from frappe.utils import now_datetime
 from frappe.utils.file_manager import save_file
 
@@ -194,7 +196,7 @@ def convert_sales_invoice_to_ubl(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("write")
+    require_sales_invoice_access(invoice)
 
     if invoice.docstatus != 1:
         frappe.throw(

enuxia_einvoice/exchange.py

@@ -9,6 +9,10 @@ from uuid import uuid4
 
 import frappe
 from frappe import _
+
+from enuxia_einvoice.permissions import (
+    require_sales_invoice_access,
+)
 from frappe.utils import now_datetime
 
 from enuxia_einvoice.sales_invoice import (
@@ -193,7 +197,7 @@ def prepare_sales_invoice_exchange(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("write")
+    require_sales_invoice_access(invoice)
 
     customer = frappe.get_doc(
         "Customer",

enuxia_einvoice/payload.py

@@ -8,6 +8,8 @@ from typing import Any
 import frappe
 from frappe import _
 
+from enuxia_einvoice.permissions import require_sales_invoice_access
+
 from enuxia_einvoice.builders.en16931 import (
     EN16931BuildError,
     build_en16931_invoice,
@@ -185,7 +187,10 @@ def generate_sales_invoice_en16931(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("read")
+    require_sales_invoice_access(
+        invoice,
+        permission="read",
+    )
 
     if invoice.docstatus != 1:
         frappe.throw(

enuxia_einvoice/payment_reporting.py

@@ -7,6 +7,10 @@ from typing import Any
 
 import frappe
 from frappe import _
+
+from enuxia_einvoice.permissions import (
+    require_sales_invoice_access,
+)
 from frappe.utils import flt, now_datetime
 
 from enuxia_einvoice.inbound_sync import (
@@ -38,7 +42,7 @@ def _get_submitted_sales_invoice(
         invoice_name,
     )
 
-    invoice.check_permission("write")
+    require_sales_invoice_access(invoice)
 
     if invoice.docstatus != 1:
         frappe.throw(

enuxia_einvoice/permissions.py

@@ -146,3 +146,24 @@ def require_exchange_access(
     require_company_access(
         exchange.company
     )
+
+
+def require_sales_invoice_access(
+    invoice,
+    *,
+    permission: str = "write",
+    minimum_role: str = ROLE_OPERATOR,
+) -> None:
+    """Autoriser une action électronique sur une facture de vente."""
+
+    require_einvoice_role(
+        minimum_role
+    )
+
+    invoice.check_permission(
+        permission
+    )
+
+    require_company_access(
+        invoice.company
+    )

enuxia_einvoice/sales_invoice.py

@@ -8,6 +8,8 @@ from uuid import uuid4
 
 import frappe
 from frappe import _
+
+from enuxia_einvoice.permissions import require_sales_invoice_access
 from frappe.utils import now_datetime
 
 
@@ -215,7 +217,7 @@ def validate_sales_invoice(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("write")
+    require_sales_invoice_access(invoice)
 
     customer = None
 

enuxia_einvoice/sending.py

@@ -11,6 +11,10 @@ from typing import Any
 
 import frappe
 from frappe import _
+
+from enuxia_einvoice.permissions import (
+    require_sales_invoice_access,
+)
 from frappe.utils import get_datetime, now_datetime
 from requests import RequestException
 
@@ -481,7 +485,7 @@ def send_sales_invoice(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("write")
+    require_sales_invoice_access(invoice)
 
     if invoice.docstatus != 1:
         frappe.throw(
@@ -700,7 +704,7 @@ def sync_sales_invoice_status(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("read")
+    require_sales_invoice_access(invoice)
 
     exchange = _get_exchange(invoice)
 

enuxia_einvoice/tests/test_payment_reporting.py

@@ -12,6 +12,15 @@ from enuxia_einvoice.payment_reporting import (
 
 class TestPaymentReporting(unittest.TestCase):
     def setUp(self) -> None:
+        permission_patcher = patch(
+            "enuxia_einvoice.payment_reporting."
+            "require_sales_invoice_access"
+        )
+        permission_patcher.start()
+        self.addCleanup(
+            permission_patcher.stop
+        )
+
         translation_patcher = patch(
             "enuxia_einvoice.payment_reporting._",
             side_effect=(

enuxia_einvoice/tests/test_workflow.py

@@ -13,6 +13,15 @@ class TestElectronicInvoiceWorkflow(unittest.TestCase):
     def setUp(self) -> None:
         """Neutraliser la traduction Frappe dans les tests unitaires purs."""
 
+        permission_patcher = patch(
+            "enuxia_einvoice.workflow."
+            "require_sales_invoice_access"
+        )
+        permission_patcher.start()
+        self.addCleanup(
+            permission_patcher.stop
+        )
+
         translation_patcher = patch(
             "enuxia_einvoice.workflow._",
             side_effect=lambda message, *args, **kwargs: message,

enuxia_einvoice/validation.py

@@ -9,6 +9,8 @@ from typing import Any
 
 import frappe
 from frappe import _
+
+from enuxia_einvoice.permissions import require_sales_invoice_access
 from frappe.utils import now_datetime
 
 from enuxia_einvoice.providers.superpdp.client import (
@@ -239,7 +241,7 @@ def validate_sales_invoice_ubl(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("write")
+    require_sales_invoice_access(invoice)
 
     exchange = _get_exchange(invoice)
 

enuxia_einvoice/workflow.py

@@ -8,6 +8,8 @@ from typing import Any
 import frappe
 from frappe import _
 
+from enuxia_einvoice.permissions import require_sales_invoice_access
+
 from enuxia_einvoice.conversion import (
     convert_sales_invoice_to_ubl,
 )
@@ -47,7 +49,7 @@ def _get_submitted_invoice(
         "Sales Invoice",
         invoice_name,
     )
-    invoice.check_permission("write")
+    require_sales_invoice_access(invoice)
 
     if invoice.docstatus != 1:
         frappe.throw(