Hi I noticed in ERPNext that all contacts and addresses are readable by all users. Is there any way to restrict sales user from seeing supplier contact and address?
I understand that I could set user permission one by one. But it is too specific and not efficient, is there any good way to restrict the permission?
Thankyou
Hmm 
I suggest a better approach for handling role permissions in this case. First, remove all permissions from the role related to contacts and addresses. Then, create a new role, like “Contact/Address,” and assign the appropriate permissions to it. If you need access to contacts and addresses, you should select the “Contact/Address” role. This way, users will only be able to see the contact and address information.
With this approach, the sales user/manager would not have the ability to see customer’s contact/address. While each user with the new role will be able to see the contact/adress list in its entirety
Is there any way to limit each user to certain group of contact/address?
Regards
Jevon
I’ve already explained that you need to work with the Role Permission Manager. Alternatively, you can create a new role based on the specific scenario and assign it to the user. It’s difficult to explain every detail here because only you will know at what level you need to manage permissions. You’ll need to practically do this locally to get a better understanding. Once you go through these steps, you’ll have a clearer idea of how it works.
From my understanding, setting permission with Role Permission Manager only allows the user to see all of the contact/address list or not at all.
ERPNext is using common contact/address doctype for both supplier and customer, hence when I give the permission to the sales user to read/write, they will be able to see the all contact and address including supplier’s contact and address, or when I do not, cannot see the contact/address at all (only able to see the reference in the customer doctype).
If I set it into “Only if creator”, Sales User cannot share common contacts/addresses with another Sales User.
Setting User permission one by one is not possible because of the large numbers of contact/address.
Is there any solution to this? to limit Purchase users to access only Supplier’s contact and addresses, and to limit Sales users to access only Customer’s contact and addresses.
Thank you for your help
Jevon
I too have the same concern. It can be filtered out by using Link document type and setting it to Customer. So you can hide the supplier related contacts.
But your question was to totally prevent sales user from accessing contact which are linked to Supplier.
I have found a solution by making a new doctype, Contact Category.
Making several categories of contact, make customization by linking the contact doctype to this new doctype, set each contact’s category, assigning the Document permission to specific user to what category they should be able to access.
Hi,
We also have the same concern and would like to implement the solution you mentioned. Can you please elaborate a bit more about the solution, enabling us to replicate the same in our system.
We’ll be thankful for your support and the solution may also help others to solve this very common and basic problem related to Business Operations…
Hi here are the steps I have taken:
Here are several of Contact Category I created:
I created a link field with Contact Category as options.
Also make “General” as default, so when a user create a new contact, it will be set automatically to General.
If needed you could add several of the user permission, so a user could see several categories, e.g. General, Internal, Customer.
All done
Best regards,
Jevon
@jevht your idea is good i tried too. it was working.
But the point here is I already have 1000s of contacts of both customers and suppliers. How to change it. This even I can make filter to link document type “Supplier” having this filter bulk edit the contact category field.
But how does it automate in newly created contacts.
Hope as per @TRACKOMATIC_INDIA there should be a solution to make permission out of child tables or someother automation.
I think this is the limitation of ERPNext, it would make sense to use the link field you describe, unfortunately I believe that requires customization to underlying codes. My approach is to utilize the user permission manager
I think for existing contacts you could just bulk update it by using import data feature. I havent tried the way to set default according to user, maybe it requires some client script to fill the field according to the condition of user role.
Or you could create client script to force the contact category to be set as “customer” when you link the document to the “customer”, i think that would be feasible.
after some trying, I used the document link to applied automatically the contact category, by using this server script. I create two server script, one for Contact, one for Address, both of which is “Before Save” Event
# List of categories that should NEVER be overwritten by automation
manual_categories = ["Internal", "Regulatory", "Intercompany"]
# Only run automation if the current category is NOT manually protected
if doc.custom_contact_category not in manual_categories:
# Initialize flags to check what links exist
has_customer = False
has_supplier = False
# Loop through all links to see what this document is connected to
for link in doc.links:
if link.link_doctype == "Customer":
has_customer = True
elif link.link_doctype == "Supplier":
has_supplier = True
# Determine the category based on what we found
if has_customer and has_supplier:
category = "Customer & Supplier"
elif has_customer:
category = "Customer"
elif has_supplier:
category = "Supplier"
else:
category = "General"
# Update your custom field
doc.custom_contact_category = category
Then I create a role-based server script to apply user permission automatically with a predefine matrix that I created. server script for “User” doctype.
# 1. Define the complete Role Permissions Matrix
role_config = {
"Sales User": {
"Data Type": ["Selling"],
"Contact Category": ["General", "Customer", "Internal"],
"Item Group": ["Products"]
},
"Purchase User": {
"Data Type": ["Buying"],
"Contact Category": ["General", "Supplier", "Internal", "Intercompany"],
"Item Group": [] # No restrictions means full global access to Item Groups
},
"Account User": {
"Data Type": ["Selling", "Buying"],
"Contact Category": ["General", "Customer", "Supplier", "Internal", "Intercompany", "Regulatory"],
"Item Group": [] # No restrictions means full global access to Item Groups
},
"System Manager": {
"Data Type": ["Selling", "Buying"],
"Contact Category": ["General", "Customer", "Supplier", "Internal", "Intercompany", "Regulatory"],
"Item Group": [] # No restrictions means full global access to Item Groups
}
}
# 2. Extract a clean list of all roles assigned to this user
user_roles = [r.role for r in doc.roles]
# 3. List of all DocTypes managed by this script
all_target_doctypes = ["Data Type", "Contact Category", "Item Group"]
for target_doctype in all_target_doctypes:
# Gather all unique allowed values based on the user's active roles
allowed_values = []
for role in user_roles:
if role in role_config and target_doctype in role_config[role]:
for value in role_config[role][target_doctype]:
if value not in allowed_values:
allowed_values.append(value)
# Fetch all existing "User Permission" records for this specific user and target DocType
existing_permissions = frappe.get_all("User Permission",
filters={
"user": doc.name,
"allow": target_doctype
},
fields=["name", "for_value"]
)
current_allowed_values = [p.for_value for p in existing_permissions]
# 4. ADD missing permissions
for value in allowed_values:
if value not in current_allowed_values:
user_perm = frappe.new_doc("User Permission")
user_perm.user = doc.name
user_perm.allow = target_doctype
user_perm.for_value = value
user_perm.apply_to_all_doctypes = 1
user_perm.insert(ignore_permissions=True)
frappe.msgprint(f"Granted permission for {target_doctype}: {value}")
# 5. REMOVE revoked permissions
for perm in existing_permissions:
if perm.for_value not in allowed_values:
frappe.delete_doc("User Permission", perm.name, ignore_permissions=True)
frappe.msgprint(f"Revoked permission for {target_doctype}: {perm.for_value}")
The result is if you assign a user as Sales User then they will immediately created User Permission based on the matrix.