fix: remove unnecessary permissions from Appointment and Appointment Booking Settings

erpnext/crm/doctype/appointment/appointment.json

@@ -102,7 +102,7 @@
   }
  ],
  "links": [],
- "modified": "2021-06-30 13:09:14.228756",
+ "modified": "2022-12-15 11:11:02.131986",
  "modified_by": "Administrator",
  "module": "CRM",
  "name": "Appointment",
@@ -121,16 +121,6 @@
    "share": 1,
    "write": 1
   },
-  {
-   "create": 1,
-   "email": 1,
-   "export": 1,
-   "print": 1,
-   "read": 1,
-   "report": 1,
-   "role": "Guest",
-   "share": 1
-  },
   {
    "create": 1,
    "delete": 1,
@@ -170,5 +160,6 @@
  "quick_entry": 1,
  "sort_field": "modified",
  "sort_order": "DESC",
+ "states": [],
  "track_changes": 1
 }

erpnext/crm/doctype/appointment/appointment.py

@@ -6,7 +6,9 @@
 
 import frappe
 from frappe import _
+from frappe.desk.form.assign_to import add as add_assignment
 from frappe.model.document import Document
+from frappe.share import add_docshare
 from frappe.utils import get_url, getdate, now
 from frappe.utils.verified_command import get_signed_params
 
@@ -130,21 +132,21 @@ def create_lead_and_link(self):
 		self.party = lead.name
 
 	def auto_assign(self):
-		from frappe.desk.form.assign_to import add as add_assignemnt
-
 		existing_assignee = self.get_assignee_from_latest_opportunity()
 		if existing_assignee:
 			# If the latest opportunity is assigned to someone
 			# Assign the appointment to the same
-			add_assignemnt({"doctype": self.doctype, "name": self.name, "assign_to": [existing_assignee]})
+			add_agent_assignment(
+				{"doctype": self.doctype, "name": self.name, "assign_to": [existing_assignee]}
+			)
 			return
 		if self._assign:
 			return
 		available_agents = _get_agents_sorted_by_asc_workload(getdate(self.scheduled_time))
 		for agent in available_agents:
 			if _check_agent_availability(agent, self.scheduled_time):
 				agent = agent[0]
-				add_assignemnt({"doctype": self.doctype, "name": self.name, "assign_to": [agent]})
+				add_agent_assignment({"doctype": self.doctype, "name": self.name, "assign_to": [agent]})
 			break
 
 	def get_assignee_from_latest_opportunity(self):
@@ -201,7 +203,7 @@ def _get_verify_url(self):
 
 
 def _get_agents_sorted_by_asc_workload(date):
-	appointments = frappe.db.get_list("Appointment", fields="*")
+	appointments = frappe.get_all("Appointment", fields="*")
 	agent_list = _get_agent_list_as_strings()
 	if not appointments:
 		return agent_list
@@ -226,7 +228,7 @@ def _get_agent_list_as_strings():
 
 
 def _check_agent_availability(agent_email, scheduled_time):
-	appointemnts_at_scheduled_time = frappe.get_list(
+	appointemnts_at_scheduled_time = frappe.get_all(
 		"Appointment", filters={"scheduled_time": scheduled_time}
 	)
 	for appointment in appointemnts_at_scheduled_time:
@@ -240,3 +242,14 @@ def _get_employee_from_user(user):
 	if employee_docname:
 		return frappe.get_doc("Employee", employee_docname)
 	return None
+
+
+def add_agent_assignment(args):
+	doctype = args.get("doctype")
+	docname = args.get("name")
+
+	for assign_to in args.get("assign_to"):
+		if not frappe.has_permission(doctype=doctype, doc=docname, user=assign_to):
+			add_docshare(doctype, docname, assign_to, flags={"ignore_share_permission": True})
+
+	add_assignment(args)

erpnext/crm/doctype/appointment_booking_settings/appointment_booking_settings.json

@@ -1,4 +1,5 @@
 {
+ "actions": [],
  "creation": "2019-08-27 10:56:48.309824",
  "doctype": "DocType",
  "editable_grid": 1,
@@ -101,7 +102,8 @@
   }
  ],
  "issingle": 1,
- "modified": "2019-11-26 12:14:17.669366",
+ "links": [],
+ "modified": "2022-12-15 11:10:13.517742",
  "modified_by": "Administrator",
  "module": "CRM",
  "name": "Appointment Booking Settings",
@@ -117,13 +119,6 @@
    "share": 1,
    "write": 1
   },
-  {
-   "email": 1,
-   "print": 1,
-   "read": 1,
-   "role": "Guest",
-   "share": 1
-  },
   {
    "create": 1,
    "email": 1,
@@ -147,5 +142,6 @@
  "quick_entry": 1,
  "sort_field": "modified",
  "sort_order": "DESC",
+ "states": [],
  "track_changes": 1
 }

erpnext/www/book_appointment/index.py

@@ -26,8 +26,12 @@ def get_context(context):
 
 @frappe.whitelist(allow_guest=True)
 def get_appointment_settings():
-	settings = frappe.get_doc("Appointment Booking Settings")
-	settings.holiday_list = frappe.get_doc("Holiday List", settings.holiday_list)
+	settings = frappe.get_cached_value(
+		"Appointment Booking Settings",
+		None,
+		["holiday_list", "advance_booking_days", "appointment_duration", "success_redirect_url"],
+		as_dict=True,
+	)
 	return settings
 
 
@@ -90,23 +94,27 @@ def get_available_slots_between(query_start_time, query_end_time, settings):
 
 @frappe.whitelist(allow_guest=True)
 def create_appointment(date, time, tz, contact):
-	format_string = "%Y-%m-%d %H:%M:%S"
-	scheduled_time = datetime.datetime.strptime(date + " " + time, format_string)
+	contact = json.loads(contact)
+	datetime_obj = datetime.datetime.strptime(date + " " + time, "%Y-%m-%d %H:%M:%S")
 	# Strip tzinfo from datetime objects since it's handled by the doctype
+	scheduled_time_obj = datetime_obj.replace(tzinfo=None)
+	scheduled_time = convert_to_system_timezone(tz, scheduled_time_obj)
 	scheduled_time = scheduled_time.replace(tzinfo=None)
-	scheduled_time = convert_to_system_timezone(tz, scheduled_time)
-	scheduled_time = scheduled_time.replace(tzinfo=None)
+
 	# Create a appointment document from form
 	appointment = frappe.new_doc("Appointment")
-	appointment.scheduled_time = scheduled_time
-	contact = json.loads(contact)
-	appointment.customer_name = contact.get("name", None)
-	appointment.customer_phone_number = contact.get("number", None)
-	appointment.customer_skype = contact.get("skype", None)
-	appointment.customer_details = contact.get("notes", None)
-	appointment.customer_email = contact.get("email", None)
-	appointment.status = "Open"
-	appointment.insert()
+	appointment.update(
+		{
+			"scheduled_time": scheduled_time,
+			"customer_name": contact.get("name", None),
+			"customer_phone_number": contact.get("number", None),
+			"customer_skype": contact.get("skype", None),
+			"customer_details": contact.get("notes", None),
+			"customer_email": contact.get("email", None),
+			"status": "Open",
+		}
+	)
+	appointment.insert(ignore_permissions=True)
 	return appointment
 
 

erpnext/www/book_appointment/verify/index.py

@@ -2,7 +2,6 @@
 from frappe.utils.verified_command import verify_request
 
 
-@frappe.whitelist(allow_guest=True)
 def get_context(context):
 	if not verify_request():
 		context.success = False