added permissions

InvenTree/part/api.py

@@ -201,6 +201,7 @@ class PartInternalPriceList(generics.ListCreateAPIView):
 
     queryset = PartInternalPriceBreak.objects.all()
     serializer_class = part_serializers.PartInternalPriceSerializer
+    permission_required = 'roles.sales_order.show'
 
     filter_backends = [
         DjangoFilterBackend

InvenTree/part/templates/part/internal_prices.html

@@ -13,7 +13,7 @@
 
 {% block details %}
 {% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
-{% if show_internal_price %}
+{% if show_internal_price and roles.sales_order.view %}
 <div id='internal-price-break-toolbar' class='btn-group'>
     <button class='btn btn-primary' id='new-internal-price-break' type='button'>
         <span class='fas fa-plus-circle'></span> {% trans "Add Internal Price Break" %}
@@ -23,6 +23,14 @@
 <table class='table table-striped table-condensed' id='internal-price-break-table' data-toolbar='#internal-price-break-toolbar'>
 </table>
 
+{% else %}
+<div class='container-fluid'>
+    <h3>{% trans "Permission Denied" %}</h3>
+
+    <div class='alert alert-danger alert-block'>
+        {% trans "You do not have permission to view this page." %}
+    </div>
+</div>
 {% endif %}
 {% endblock %}
 
@@ -30,7 +38,7 @@
 {{ block.super }}
 
 {% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
-{% if show_internal_price %}
+{% if show_internal_price and roles.sales_order.view %}
 function reloadPriceBreaks() {
     $("#internal-price-break-table").bootstrapTable("refresh");
 }

InvenTree/part/templates/part/navbar.html

@@ -96,7 +96,7 @@
         </a>
     </li>
     {% endif %}
-    {% if show_internal_price %}
+    {% if show_internal_price and roles.sales_order.view %}
     <li class='list-group-item {% if tab == "internal-prices" %}active{% endif %}' title='{% trans "Internal Price Information" %}'>
         <a href='{% url "part-internal-prices" part.id %}'>
             <span class='menu-tab-icon fas fa-dollar-sign' style='width: 20px;'></span>

InvenTree/part/templates/part/order_prices.html

@@ -14,6 +14,7 @@
 
 {% block details %}
 {% default_currency as currency %}
+{% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
 
 {% crispy form %}
 
@@ -77,6 +78,7 @@
     {% endif %}
 {% endif %}
 
+{% if show_internal_price and roles.sales_order.view %}
 {% if total_internal_part_price %}
     <tr>
         <td><b>{% trans 'Internal Price' %}</b></td>
@@ -89,6 +91,7 @@
         <td colspan='2'>{% include "price.html" with price=total_internal_part_price %}</td>
     </tr>
 {% endif %}
+{% endif %}
 
 {% if total_part_price %}
     <tr>

InvenTree/part/templates/part/part_pricing.html

@@ -3,7 +3,10 @@
 {% load i18n inventree_extras %}
 
 {% block pre_form_content %}
+
 {% default_currency as currency %}
+{% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
+
 <table class='table table-striped table-condensed table-price-two'>
     <tr>
         <td><b>{% trans 'Part' %}</b></td>
@@ -74,6 +77,7 @@
     </table>
 {% endif %}
 
+{% if show_internal_price and roles.sales_order.view %}
 {% if total_internal_part_price %}
     <h4>{% trans 'Internal Price' %}</h4>
     <table class='table table-striped table-condensed table-price-two'>
@@ -87,6 +91,7 @@
         </tr>
     </table>
 {% endif %}
+{% endif %}
 
 {% if total_part_price %}
     <h4>{% trans 'Sale Price' %}</h4>

InvenTree/part/views.py

@@ -2808,6 +2808,7 @@ class PartInternalPriceBreakCreate(PartSalePriceBreakCreate):
     model = PartInternalPriceBreak
     form_class = part_forms.EditPartInternalPriceBreakForm
     ajax_form_title = _('Add Internal Price Break')
+    permission_required = 'roles.sales_order.add'
 
 
 class PartInternalPriceBreakEdit(PartSalePriceBreakEdit):
@@ -2816,6 +2817,7 @@ class PartInternalPriceBreakEdit(PartSalePriceBreakEdit):
     model = PartInternalPriceBreak
     form_class = part_forms.EditPartInternalPriceBreakForm
     ajax_form_title = _('Edit Internal Price Break')
+    permission_required = 'roles.sales_order.change'
 
 
 class PartInternalPriceBreakDelete(PartSalePriceBreakDelete):
@@ -2823,3 +2825,4 @@ class PartInternalPriceBreakDelete(PartSalePriceBreakDelete):
 
     model = PartInternalPriceBreak
     ajax_form_title = _("Delete Internal Price Break")
+    permission_required = 'roles.sales_order.delete'