fix: remove unnecessary permissions from Appointment and Appointment …

…Booking Settings (#33358) (#33395)

erpnext/crm/doctype/appointment/appointment.json

@@ -102,7 +102,7 @@
   }
  ],
  "links": [],
- "modified": "2021-06-30 13:09:14.228756",
+ "modified": "2022-12-15 11:11:02.131986",
  "modified_by": "Administrator",
  "module": "CRM",
  "name": "Appointment",
@@ -121,16 +121,6 @@
    "share": 1,
    "write": 1
   },
-  {
-   "create": 1,
-   "email": 1,
-   "export": 1,
-   "print": 1,
-   "read": 1,
-   "report": 1,
-   "role": "Guest",
-   "share": 1
-  },
   {
    "create": 1,
    "delete": 1,
@@ -170,5 +160,6 @@
  "quick_entry": 1,
  "sort_field": "modified",
  "sort_order": "DESC",
+ "states": [],
  "track_changes": 1
 }

erpnext/crm/doctype/appointment/appointment.py

@@ -6,7 +6,9 @@
 
 import frappe
 from frappe import _
+from frappe.desk.form.assign_to import add as add_assignment
 from frappe.model.document import Document
+from frappe.share import add_docshare
 from frappe.utils import get_url, getdate, now
 from frappe.utils.verified_command import get_signed_params
 
@@ -130,21 +132,18 @@ def create_lead_and_link(self):
 		self.party = lead.name
 
 	def auto_assign(self):
-		from frappe.desk.form.assign_to import add as add_assignemnt
-
 		existing_assignee = self.get_assignee_from_latest_opportunity()
 		if existing_assignee:
 			# If the latest opportunity is assigned to someone
 			# Assign the appointment to the same
-			add_assignemnt({"doctype": self.doctype, "name": self.name, "assign_to": [existing_assignee]})
+			self.assign_agent(existing_assignee)
 			return
 		if self._assign:
 			return
 		available_agents = _get_agents_sorted_by_asc_workload(getdate(self.scheduled_time))
 		for agent in available_agents:
 			if _check_agent_availability(agent, self.scheduled_time):
-				agent = agent[0]
-				add_assignemnt({"doctype": self.doctype, "name": self.name, "assign_to": [agent]})
+				self.assign_agent(agent[0])
 			break
 
 	def get_assignee_from_latest_opportunity(self):
@@ -199,9 +198,15 @@ def _get_verify_url(self):
 		params = {"email": self.customer_email, "appointment": self.name}
 		return get_url(verify_route + "?" + get_signed_params(params))
 
+	def assign_agent(self, agent):
+		if not frappe.has_permission(doc=self, user=agent):
+			add_docshare(self.doctype, self.name, agent, flags={"ignore_share_permission": True})
+
+		add_assignment({"doctype": self.doctype, "name": self.name, "assign_to": [agent]})
+
 
 def _get_agents_sorted_by_asc_workload(date):
-	appointments = frappe.db.get_list("Appointment", fields="*")
+	appointments = frappe.get_all("Appointment", fields="*")
 	agent_list = _get_agent_list_as_strings()
 	if not appointments:
 		return agent_list
@@ -226,7 +231,7 @@ def _get_agent_list_as_strings():
 
 
 def _check_agent_availability(agent_email, scheduled_time):
-	appointemnts_at_scheduled_time = frappe.get_list(
+	appointemnts_at_scheduled_time = frappe.get_all(
 		"Appointment", filters={"scheduled_time": scheduled_time}
 	)
 	for appointment in appointemnts_at_scheduled_time:

erpnext/crm/doctype/appointment_booking_settings/appointment_booking_settings.json

@@ -1,4 +1,5 @@
 {
+ "actions": [],
  "creation": "2019-08-27 10:56:48.309824",
  "doctype": "DocType",
  "editable_grid": 1,
@@ -101,7 +102,8 @@
   }
  ],
  "issingle": 1,
- "modified": "2019-11-26 12:14:17.669366",
+ "links": [],
+ "modified": "2022-12-15 11:10:13.517742",
  "modified_by": "Administrator",
  "module": "CRM",
  "name": "Appointment Booking Settings",
@@ -117,13 +119,6 @@
    "share": 1,
    "write": 1
   },
-  {
-   "email": 1,
-   "print": 1,
-   "read": 1,
-   "role": "Guest",
-   "share": 1
-  },
   {
    "create": 1,
    "email": 1,
@@ -147,5 +142,6 @@
  "quick_entry": 1,
  "sort_field": "modified",
  "sort_order": "DESC",
+ "states": [],
  "track_changes": 1
 }

erpnext/www/book_appointment/index.js

@@ -2,8 +2,6 @@ frappe.ready(async () => {
     initialise_select_date();
 })
 
-window.holiday_list = [];
-
 async function initialise_select_date() {
     navigate_to_page(1);
     await get_global_variables();
@@ -20,7 +18,6 @@ async function get_global_variables() {
     window.timezones = (await frappe.call({
         method:'erpnext.www.book_appointment.index.get_timezones'
     })).message;
-    window.holiday_list = window.appointment_settings.holiday_list;
 }
 
 function setup_timezone_selector() {

erpnext/www/book_appointment/index.py

@@ -26,8 +26,12 @@ def get_context(context):
 
 @frappe.whitelist(allow_guest=True)
 def get_appointment_settings():
-	settings = frappe.get_doc("Appointment Booking Settings")
-	settings.holiday_list = frappe.get_doc("Holiday List", settings.holiday_list)
+	settings = frappe.get_cached_value(
+		"Appointment Booking Settings",
+		None,
+		["advance_booking_days", "appointment_duration", "success_redirect_url"],
+		as_dict=True,
+	)
 	return settings
 
 
@@ -106,7 +110,7 @@ def create_appointment(date, time, tz, contact):
 	appointment.customer_details = contact.get("notes", None)
 	appointment.customer_email = contact.get("email", None)
 	appointment.status = "Open"
-	appointment.insert()
+	appointment.insert(ignore_permissions=True)
 	return appointment
 
 

erpnext/www/book_appointment/verify/index.py

@@ -2,7 +2,6 @@
 from frappe.utils.verified_command import verify_request
 
 
-@frappe.whitelist(allow_guest=True)
 def get_context(context):
 	if not verify_request():
 		context.success = False