permissions-expert

Explain and optimize Frappe permissions workflows using has_permission and related hooks.

1|Updated Jan 16, 2025

Search Tags:#workflow #permissions #rbac #frappe #has_permission #permission_query_conditions

Ready to run

npx skills add https://github.com/kehwar/frappe_tweaks --skill permissions-expert

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: permissions-expert
Source: https://github.com/kehwar/frappe_tweaks/tree/main/.github/skills/permissions-expert
Command: npx skills add https://github.com/kehwar/frappe_tweaks --skill permissions-expert

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Frappe permissions can be complex, error-prone, and hard to audit. This skill consolidates best practices, reference patterns, and practical examples to help developers design secure, maintainable access controls.

Core Features & Use Cases

Comprehensive guidance on permission evaluation order including has_permission, permission_query_conditions, write_permission_query_conditions, has_website_permission, and workflow hooks.
Practical examples covering role-based permissions, User Permissions, sharing, perm levels, and workflow-based restrictions to troubleshoot and implement custom logic.
Real-world scenarios showing how to combine multiple hooks for robust security, performance, and maintainability.

Quick Start

Provide a concrete example of implementing a has_permission hook for a sample DocType and verify access using test users.

Frequently Asked Questions about permissions-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement a has_permission hook in Frappe to customize DocType access control?▼

Frappe evaluates has_permission hooks to enforce custom access control by checking role permissions, User Permissions, and sharing rules before granting or denying access to a specific DocType record.

What is the evaluation order of Frappe permission hooks like permission_query_conditions and has_website_permission?▼

The Frappe permission evaluation order applies role-level checks first, then User Permissions, followed by custom hooks like has_permission, permission_query_conditions, write_permission_query_conditions, and has_website_permission to gate access securely.

How do I restrict data visibility in Frappe using permission_query_conditions for multi-tenant scenarios?▼

You can restrict data visibility in multi-tenant scenarios by implementing permission_query_conditions to append SQL filters, ensuring users only query and view records that match their assigned User Permissions and tenant boundaries.

Can I combine Frappe workflow transitions with role-based permissions to gate document state changes?▼

Yes, you can combine Frappe workflow transitions with role-based permissions to gate document state changes, ensuring users only interact with allowed workflow states based on their assigned roles and permission levels.

Why are my Frappe User Permissions not overriding role permissions as expected?▼

Frappe User Permissions might not override role permissions if custom has_permission logic bypasses standard checks, or if sharing rules and permlevels inadvertently grant broader access than intended.

What is the best way to audit and troubleshoot complex Frappe permission logic across multiple hooks?▼

The best way to audit Frappe permission logic is to trace the evaluation order across has_permission, permission_query_conditions, and workflow hooks, verifying access with test users to isolate conflicting rules and maintain robust security.