Audit trail for role permissions changes

aakvatech · May 25, 2021, 5:05pm

Has anybody found a need of audit trail for role permissions?
Currently user permission changes in “Role Permissions Manager” are not tracked leaving a gap during audits.

github.com

frappe/frappe/blob/03efb185711660fa504365a0a5cbec3e447bd773/frappe/core/page/permission_manager/permission_manager.py#L114


      
          	"""
          	frappe.only_for("System Manager")
          	out = update_permission_property(doctype, role, permlevel, ptype, value)
          	return 'refresh' if out else None
          
          
@frappe.whitelist()
          def remove(doctype, role, permlevel):
          	frappe.only_for("System Manager")
          	setup_custom_perms(doctype)
          
          
	name = frappe.get_value('Custom DocPerm', dict(parent=doctype, role=role, permlevel=permlevel))
          
          
	frappe.db.sql('delete from `tabCustom DocPerm` where name=%s', name)
          	if not frappe.get_all('Custom DocPerm', dict(parent=doctype)):
          		frappe.throw(_('There must be atleast one permission rule.'), title=_('Cannot Remove'))
          
          
	validate_permissions_for_doctype(doctype, for_remove=True, alert=True)
          
          
@frappe.whitelist()
          def reset(doctype):
          	frappe.only_for("System Manager")

This is running an SQL delete statement and so it doesn’t leave a trace in Deleted Documents DocType.