[Pandiyan5273]

Issue

• Authenticated customers cannot create a Shopping Cart Payment Request for their own submitted order or invoice on v16 because the endpoint requires Desk Payment Request creation and document read permissions.
• Refs Guest checkout fails on Shopping Cart payment request with PermissionError after upgrade (v16) #52844. This fixes the ERPNext permission failure; Webshop's existing GET Pay link also needs the companion version-16 PR. Anonymous Guest checkout is outside this fix.

Steps to replicate

• Install Payments, configure a gateway account, and link a website user with the Customer role to a customer.
• Submit an unpaid Sales Order or Sales Invoice for that customer, without granting the website user Desk Payment Request creation permission.
• Sign in as that user and submit a CSRF-protected POST to make_payment_request with the document name/type, order_type=Shopping Cart, and submit_doc=1.

Actual behavior

• The customer's own submitted document is rejected with a Payment Request creation PermissionError; the standard ERPNext portal also hides its Pay button.

Expected behavior

• Linked customers can pay their own submitted, payable Sales Orders and Sales Invoices without additional Desk permissions.
• Other customers' documents, drafts, cancelled documents, purchases, and Guest requests remain denied; staff-created draft requests and staff permission checks remain protected.

Fix

• Authorize the customer against the saved document's website ownership, derive payment details from that document, and scope internal payment creation/submission and retries to that authorized path.
• Align portal Pay visibility with this authorization and reuse internal account/subscription resolution while preserving the public methods' permission checks.

Validation

• The customer regression fails before the fix. All 42 Payment Request tests and 5 order-page tests pass, as does the regression with Webshop installed. Repository hooks pass.
• With the companion Webshop patch, actual rendered-form/handler flows pass for an order of 1,000 and an invoice with 600 remaining, including CSRF validation, retry, staff-draft protection, payment/invoice creation, balanced GL, zero invoice payment-ledger balance, and normal cancellation.
• Validated on ERPNext v16 a28009aca7 / Frappe fcb38c6fd4. External gateway controller, payment URL, and email were mocked; no browser, real-gateway, loyalty-redemption, or anonymous-callback tests ran.

Backport needed

• Version 16: This PR targets version-16-hotfix; paired Webshop changes are required for its checkout button.
• Develop: No ERPNext frontport needed. The customer authorization path is already present through fix(portal): let customers pay their orders from the portal #62535 and fix(payment request): let portal customers submit their own payment request #63131; the separate Webshop develop form correction is required.
• Version 15: Yes, by inspection at d17086df9f: the endpoint and portal eligibility helper still require Desk permissions. An adapted ERPNext/Webshop pair and v15 runtime validation are still required.

Companion PRs

• Required Webshop v16 form correction: fix(portal): submit checkout payments with CSRF protection (v16) webshop#415. Deploy both v16 fixes together for customer checkout.
• Webshop develop form correction: fix(portal): submit checkout payments with CSRF protection webshop#414.

[mergify]

Queue requested — the merge queue status continues in this comment ↓.

[mergify]

❌ Left the queue · Python Unit Tests (3) fails with this pull request

30 min in the queue, 19 min of it CI.

So far

• ✅ Entered the queue Sun 8 Nov, 16:49 · rule default · triggered by @khushi8112 with the merge queue checkbox
• ❌ Checks failed · draft merge queue: checking #64260 on version-16-hotfix (d01ee4e) #64977
• 🚫 Left the queue 17:20 · 1a9f6d6

The failure is in this pull request. It failed tested alone on top of version-16-hotfix.

Reason

The merge conditions cannot be satisfied due to failing checks

• Python Unit Tests (3)

Failing checks:

• ❌ Python Unit Tests (3) (job log)

To get back in the queue

• Push a fix: the pull request is queued again once its queue conditions match.
• If the failure is a flake, tick the box below to queue it again as it is.

Merge conditions not met when it left the queue

• any of:
  • -files~=^(?!erpnext/locale/main\.pot$)
  • all of:
    • check-success=Python Unit Tests (1)
    • check-success=Python Unit Tests (3)
    • check-success=Patch Test
    • check-success=Python Unit Tests (2)
    • check-success=Python Unit Tests (4)

Requeue requested — the merge queue status continues in this comment ↓.

2 merge conditions met

• #review-threads-unresolved = 0 · required by GitHub branch protection
• github-review-approved · required by GitHub branch protection

_{Times in UTC · dashboard · how the merge queue works}

[Pandiyan5273]

@Mergifyio queue

[mergify]

✅ Merged into version-16-hotfix as 8bb8244 at 07:55 UTC

Merged together with #64627, #64573. 36 min in the queue, 27 min of it CI.

So far

• ✅ Entered the queue Tue 10 Nov, 07:19 · rule default · triggered by @Pandiyan5273 with the @mergifyio queue command
• ✅ Passed · draft merge queue: merged #64627, #64260, #64573: fix(accounts): retain payment request on advance allocation (backport #64511) (+2 more) #65271
• ✅ Merged 07:55 · 8bb8244 · merge

3 merge conditions met

• #review-threads-unresolved = 0 · required by GitHub branch protection
• github-review-approved · required by GitHub branch protection
• any of:
  • all of:
    • check-success=Patch Test
    • check-success=Python Unit Tests (1)
    • check-success=Python Unit Tests (2)
    • check-success=Python Unit Tests (3)
    • check-success=Python Unit Tests (4)
  • -files~=^(?!erpnext/locale/main\.pot$)

_{Times in UTC · dashboard · how the merge queue works}