Best practice for restricting document visibility based on Owner 'OR' Approver

Frappe Framework Permissions
1

I have created a custom DocType called DocOps.

Each DocOps record has:

  • The standard Owner (Record creator)

  • A custom Approver field

Requirement

For a normal user (for example, [email protected]), I want the user to be able to view only those DocOps records that satisfy either of the following conditions:

  1. The document was created by the user (Owner = current user), OR

  2. The user is selected as the Approver.

The user should not be able to see any other DocOps records.

For example:

DocOps Owner Approver Should John See It?
DOC-001 John Mary :white_check_mark: Yes
DOC-002 Mary John :white_check_mark: Yes
DOC-003 Mary David :cross_mark: No
DOC-004 John John :white_check_mark: Yes

What I’m looking for

I would like to know what is considered the recommended or standard implementation in Frappe for this type of requirement.

I am looking for a solution that aligns with Frappe’s permission framework and is generally followed in production implementations, rather than a workaround.

I’d appreciate hearing how experienced Frappe developers or implementation partners typically handle this scenario.

2

check out frappe user permission.

3

I tried using User Permissions, but they don’t satisfy this requirement. Since User Permissions are applied independently to each permitted Link field, the effective result is an AND condition. This means a document is visible only when all applicable User Permission conditions are satisfied. In my use case, I need an OR condition: the user should be able to view a document if they are either the Owner or the Approver. If one of these conditions is true, the document should remain visible even if the other is not.

4

You can control this from hook.py, you need to write your own code and inject it using permission_query_conditions in hooks.py

5

We are not using any custom code; we’re handling everything through the GUI. Is there a way to configure this using the GUI? Alternatively, could you share any documentation, guide, or spreadsheet related to permission handling.

6

Hi @spathakvincular.in

Both requirements are simple.

  1. Define role permission manager for that doctype for a role with only if creator check on.
  2. Insert custom link field (user) in the same doctype header and match approver with frappe.session.user condition in depends on section.
  3. Applying workflow can also serve the purpose additionally.
7

Hi @spathakvincular.in

Try this (I could not find the proper documentation but its worth a shot): -

Build → Server Script → Script Type → Permission Query
(there is an example right at the bottom)

Hope it helps