fix(crm): require change permission for customer user invites

[nijel]

Motivation

• The customer detail view exposed a mutating add_customer_user POST action while the view was protected only by the read permission payments.view_customer, allowing read-only staff to provision/link users to customers.
• Customer.users membership grants access to sensitive self-service data, so adding users must require a stronger write-level permission.
• The change aims to prevent privilege escalation by requiring an explicit write permission before performing the invite/link operation.

Description

• Require payments.change_customer before executing the add_customer_user mutation by adding a check_add_customer_user_permission guard in weblate_web/crm/views.py and calling it at the start of add_customer_user.
• Add a context flag can_add_customer_user in CustomerDetailView.get_context_data to expose whether the current user has the change permission.
• Hide the Add-user form in weblate_web/crm/templates/payments/customer_detail.html unless can_add_customer_user is true.
• Add two regression tests in weblate_web/crm/tests.py verifying that a read-only staff user (with only view_customer) does not see the form and receives HTTP 403 when POSTing the add action.

Testing

• Ran pytest -q weblate_web/crm/tests.py -k 'readonly_staff or adds_hosted_user' and the selected tests passed: 3 passed, 93 deselected.
• The hosted-user invite tests exercised the successful invite path and still pass under the new permission guard when executed with a user that has the required permissions.
• No other test suites were run as part of this change; the modification is intentionally minimal to restrict authorization for the new mutation.

---

Codex Task

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	✅ No changes detected	-	May 26, 2026, 6:03 PM

[Copilot]

Pull request overview

This PR tightens authorization around the CRM “Add user to customer” action to prevent read-only staff (with only payments.view_customer) from performing a mutating invite/link operation that grants access to customer self-service data.

Changes:

• Enforce payments.change_customer before executing the add_customer_user POST mutation in CustomerDetailView.
• Add a can_add_customer_user context flag and hide the add-user form in the customer detail template when the user lacks the change permission.
• Add regression tests for read-only staff UI hiding and POST rejection.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
weblate_web/crm/views.py	Adds a permission guard for the add-customer-user mutation and exposes a context flag for template gating.
weblate_web/crm/tests.py	Adds regression tests asserting read-only staff can’t see or perform the add-user action.
weblate_web/crm/templates/payments/customer_detail.html	Hides the add-user form unless the view indicates the user has payments.change_customer.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.58%. Comparing base (2da36a2) to head (cf6a673).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3847      +/-   ##
==========================================
- Coverage   88.60%   88.58%   -0.02%     
==========================================
  Files          71       71              
  Lines       10834    10856      +22     
  Branches      952      953       +1     
==========================================
+ Hits         9599     9617      +18     
- Misses        909      913       +4     
  Partials      326      326              

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.