Enforce Flow Model permission at runtime

[ShrihariMahabal]

Closes #59

Model selection was never permission-checked at runtime — assemble() only checked enabled, so any user could pass any model name to start_run regardless of User Permission restrictions. Admins can now restrict which Flow Models a user can run via standard Frappe User Permissions, and this is enforced where every session/run resolves its model.

[greptile-apps]

Confidence Score: 4/5

Safe to merge; the change is narrow and well-tested, though background-job user context deserves a quick sanity check.

The guard is correct and the tests are solid, but assemble() is also called from queue workers — if those run as Administrator, the permission check passes unconditionally and the restriction is silently bypassed. Worth confirming the job-enqueueing code preserves (or re-sets) the originating user before relying on this check in async flows.

flow/flow/doctype/flow_agent/flow_agent.py — confirm assemble() callers in background jobs set the correct Frappe user before the check runs.

_{Reviews (1): Last reviewed commit: "feat: enforce Flow Model read permission..." | Re-trigger Greptile}

[greptile-apps]

Permission check bypassed in background jobs — frappe.has_permission reads frappe.session.user, so if any caller of assemble() runs as Administrator in a queue worker (common in Frappe background jobs), the check always passes and the User Permission restriction is silently skipped. Verify that start_run and any enqueue call preserves or re-sets the originating user before this gate can be trusted end-to-end.

[ShrihariMahabal]

Routing a run through the scheduler requires creating/editing a Flow Trigger, which is System Manager-only. A restricted (non-admin) user can't do it. If they could, they'd be an admin and the restriction is moot anyway.

[greptile-apps]

That's a fair point — if Flow Trigger creation/editing is gated to System Manager, then the only path to a scheduler-triggered background job (where session user might be Administrator) is already admin-only, making the restriction self-reinforcing.

The remaining question is whether start_run called directly (via HTTP/API by a restricted user) ever enqueues a background job that calls assemble() inside the worker. If assemble() is always called synchronously in the web worker before any enqueueing, frappe.session.user is correct and the check is sound. If it's called inside an enqueued job, the session user would be whatever the worker runs as.

Do you want me to look at start_run to confirm?

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.