fix: harden employee profile and project access

Author: Rocket-Quack

time_tracking/time_tracking/doctype/time_tracking_profile/test_time_tracking_profile.py

@@ -109,3 +109,14 @@ def test_profile_insert_creates_opening_ledgers(self):
 			},
 		)
 		self.assertTrue(vacation_entry)
+
+	def test_employee_can_load_profile_ui_settings_without_settings_read_access(self):
+		user = self._make_user("ui-settings")
+
+		frappe.set_user(user)
+		settings = frappe.call(
+			"time_tracking.time_tracking.doctype.time_tracking_profile.time_tracking_profile.get_profile_ui_settings"
+		)
+
+		self.assertIn("track_target_adjustments", settings)
+		self.assertIn("require_project_assignment", settings)

time_tracking/time_tracking/doctype/time_tracking_profile/time_tracking_profile.js

@@ -11,36 +11,45 @@ function applyRateSettings(frm) {
 }
 
 const DEFAULT_WEEKS_PER_MONTH = 52 / 12;
-const SETTINGS_DOCTYPE = "Time Tracking Settings";
-const TRACK_TARGET_ADJUSTMENTS_FIELD = "track_target_adjustments";
-const REQUIRE_PROJECT_ASSIGNMENT_FIELD = "require_project_assignment";
-
-function getTrackTargetAdjustmentsSetting(frm) {
-	return frappe.db
-		.get_single_value(SETTINGS_DOCTYPE, TRACK_TARGET_ADJUSTMENTS_FIELD)
-		.then((value) => {
-			return Number(value) === 1;
-		});
+let profileUiSettingsPromise = null;
+
+function getProfileUiSettings() {
+	if (!profileUiSettingsPromise) {
+		profileUiSettingsPromise = frappe
+			.call({
+				method: "time_tracking.time_tracking.doctype.time_tracking_profile.time_tracking_profile.get_profile_ui_settings",
+			})
+			.then((response) => response.message || {})
+			.catch(() => {
+				profileUiSettingsPromise = null;
+				return {
+					track_target_adjustments: false,
+					require_project_assignment: false,
+				};
+			});
+	}
+
+	return profileUiSettingsPromise;
+}
+
+function getTrackTargetAdjustmentsSetting() {
+	return getProfileUiSettings().then((settings) => Boolean(settings.track_target_adjustments));
 }
 
 function applyTargetAdjustmentVisibility(frm) {
 	if (!frm.fields_dict.target_adjustments) {
 		return;
 	}
 
-	getTrackTargetAdjustmentsSetting(frm).then((enabled) => {
+	getTrackTargetAdjustmentsSetting().then((enabled) => {
 		frm.set_df_property("target_adjustments_section", "hidden", !enabled);
 		frm.set_df_property("target_adjustments", "hidden", !enabled);
 		frm.refresh_field("target_adjustments");
 	});
 }
 
 function getRequireProjectAssignmentSetting() {
-	return frappe.db
-		.get_single_value(SETTINGS_DOCTYPE, REQUIRE_PROJECT_ASSIGNMENT_FIELD)
-		.then((value) => {
-			return Number(value) === 1;
-		});
+	return getProfileUiSettings().then((settings) => Boolean(settings.require_project_assignment));
 }
 
 function applyProjectAssignmentVisibility(frm) {
@@ -121,7 +130,7 @@ function openTargetSwitchDialog(frm, newPeriod) {
 	const dialogTitle =
 		newPeriod === "Monthly" ? __("Switch to Monthly Target") : __("Switch to Weekly Target");
 
-	getTrackTargetAdjustmentsSetting(frm).then((trackAdjustments) => {
+	getTrackTargetAdjustmentsSetting().then((trackAdjustments) => {
 		const fields = [
 			{
 				fieldtype: "HTML",
@@ -221,7 +230,7 @@ function openTargetAdjustmentDialog(frm, targetPeriod, labelSuffix, direction) {
 	const actionLabel =
 		direction > 0 ? __("Increase {0}", [labelSuffix]) : __("Decrease {0}", [labelSuffix]);
 
-	getTrackTargetAdjustmentsSetting(frm).then((trackAdjustments) => {
+	getTrackTargetAdjustmentsSetting().then((trackAdjustments) => {
 		const fields = [
 			{
 				fieldname: "hours",

time_tracking/time_tracking/doctype/time_tracking_profile/time_tracking_profile.py

@@ -314,6 +314,14 @@ def _require_project_assignment_setting():
 	return cint(frappe.db.get_single_value("Time Tracking Settings", "require_project_assignment") or 0)
 
 
+@frappe.whitelist()
+def get_profile_ui_settings():
+	return {
+		"track_target_adjustments": bool(_track_target_adjustments_enabled()),
+		"require_project_assignment": bool(_require_project_assignment_setting()),
+	}
+
+
 def get_permission_query_conditions(user):
 	if not user:
 		user = frappe.session.user

time_tracking/time_tracking/doctype/time_tracking_project/test_time_tracking_project.py

@@ -1,6 +1,7 @@
 from uuid import UUID
 
 import frappe
+from frappe.permissions import has_permission
 from frappe.tests.utils import FrappeTestCase
 from frappe.utils import today
 
@@ -108,3 +109,13 @@ def test_unbillable_time_counts_hours_but_not_revenue(self):
 		self.assertEqual(project.actual_hours, 2)
 		self.assertEqual(project.actual_amount, 100)
 		self.assertEqual(project.actual_pay_amount, 100)
+
+	def test_employee_has_no_direct_project_read_access(self):
+		user = self._make_user("projectread")
+		project = self._make_project(self._unique("Restricted Read"))
+
+		frappe.set_user(user)
+
+		self.assertFalse(has_permission("Time Tracking Project", "read", doc=project.name))
+		with self.assertRaises(frappe.PermissionError):
+			frappe.client.get("Time Tracking Project", project.name)

time_tracking/time_tracking/doctype/time_tracking_project/time_tracking_project.json

@@ -346,18 +346,6 @@
    "share": 1,
    "write": 1
   },
-  {
-   "read": 1,
-   "role": "Employee"
-  },
-  {
-   "read": 1,
-   "role": "Desk User"
-  },
-  {
-   "read": 1,
-   "role": "Time Tracking Employee"
-  },
   {
    "read": 1,
    "role": "Time Tracking Manager"