Repository navigation
fix(core): supplier maintainers can edit but not delete suppliers - #19
Merged
Merged
Conversation
#15 gave srm_supplier_admin and srm_admin modifyAllRecords on srm_supplier so category managers could review suppliers imported by an admin. The platform's modifyAllRecords also grants delete (objectstack#25470), so category managers and buyer leads could delete any supplier and cascade its contacts and certificates. Follow the srm_material workaround instead: srm_supplier OWD is public_read_write for now, modifyAllRecords is dropped, and srm_quality keeps its edit grant only for certificate writes with every supplier field read-only through FLS. Tests cover edit-not-delete for category managers and buyer leads, and read-only for SQE, buyers and AP. Claude-Session: https://claude.ai/code/session_01WD2qxFMbYUkbEnsSXW7PQj Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by 田騏 · project thread
为什么
#15 为了让品类经理能复核别人导入的供应商，给
srm_supplier_admin（品类经理、采购主管）和srm_admin开了modifyAllRecords。平台的modifyAllRecords会连删除一起放开（objectstack#25470），结果品类经理和采购主管能删除任何供应商，联系人、证书随master_detail级联删除。设计上删除只给系统管理员。修法由田騏在项目线程里选定：照
srm_material的临时做法放宽 OWD。改了什么
srm_supplierpublic_read_write（目标仍是public_read，注释与 02 §4.1 写明临时、链接 objectstack#25470）srm_supplier_admin、srm_adminmodifyAllRecords，回到allowEdit+allowDelete: falsesrm_qualitycontrolled_by_parent要求父记录可编辑），供应商全部字段经 FLS 只读（按对象字段生成，新增字段自动覆盖）验证
pnpm validate、lint、typecheck、i18n:check、test（10 个文件全部通过）、build。Generated by Claude Code