Attempting to setup our first branch - and created a cost center tree. All prior transactions to date have used the default cost center (Main) and are in a separate arm of tree. Created first accounts user for branch and applied user permission - restricting to that branch cost center per ERPNext documentation.
However when this user logs in - they are still able to see the company balance sheet and income statement if no cost center filter is selected in the reports. As soon as their cost center filter is applied - then things go to zero.
Is the source of the problem that prior transactions dont have a cost center applied to them? Or that the user setup still permits user to have a choice of “no/blank” cost center in the financial reports? Session default - is set at a user level and dissappears as soon as they logout. How to force user to always have branch cost center selected in financial reports?
Appreciate any guidance on how to resolve. Thanks.
Thanks for taking the time to answer - strict user permission was already enabled in system settings. Disabling/re-enabling has no change. When branch user opens P&L - by default the cost center filter is set to blank and he is able to see company level reports. The drop down for the filter correctly only shows 1 option of cost center - which is the branch filter as set by the user permission. But report defaults to blank cost center - so it seems for my install - apply strict user permission is still showing documents / data for blank.
Our install is standard - with no customization or apps installed. I update bench with --reset flag each time.
typically standard report fetches data via frappe.db.sql( pure SQL) which does not respect user permission, for the reported issue, the viable option is to set cost center filter as mandatory, maybe via custom app js hooks or simply copy as custom report and adjust as needed.
Setting a default cost center for a user (btw I cannot find under user settings) will force a standard report to apply a filter? I am assuming if anything the user permission should be applied.
It would seem meaningless to have user permission, if any user can escape the permission by just searching for a standard report or using blank in their queries? Something does not feel right.
