From c4d533038fc83abab6bb149c9374d510580c6741 Mon Sep 17 00:00:00 2001
From: Alexey Nikitin <tank@bohr.su>
Date: Fri, 19 Jun 2026 08:03:44 +0400
Subject: [PATCH 1/5] fix: pass apps.json to image build via secret mount

The build checks out frappe_docker (main), whose layered Containerfile now reads
apps.json from a BuildKit secret (id=apps_json) instead of the old
APPS_JSON_BASE64 build-arg. The workflow still passed the apps list through that
build-arg, so it was silently dropped: bench init ran without erpnext, payments
or hrms, and the published version-15 and stable images shipped frappe only.

Pass apps.json via secret-files so it reaches the Containerfile's secret mount.
---
 .github/workflows/build_image.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build_image.yml b/.github/workflows/build_image.yml
index 76aa8c4986..476275a355 100644
--- a/.github/workflows/build_image.yml
+++ b/.github/workflows/build_image.yml
@@ -40,8 +40,6 @@ jobs:
           
       - name: Set Branch
         run: |
-          export APPS_JSON_PATH='${{ github.workspace }}/.github/helper/apps.json'
-          echo "APPS_JSON_BASE64=$(cat $APPS_JSON_PATH | base64 -w 0)" >> $GITHUB_ENV
           echo "FRAPPE_BRANCH=version-15" >> $GITHUB_ENV
 
       - name: Set Image Tag
@@ -63,4 +61,5 @@ jobs:
             ghcr.io/${{ github.repository }}:${{ env.IMAGE_TAG }}
           build-args: |
             "FRAPPE_BRANCH=${{ env.FRAPPE_BRANCH }}"
-            "APPS_JSON_BASE64=${{ env.APPS_JSON_BASE64 }}"
\ No newline at end of file
+          secret-files: |
+            apps_json=${{ github.workspace }}/.github/helper/apps.json
\ No newline at end of file

From 2c6c4b1e310176ce0dea37715cde9f0171539fb9 Mon Sep 17 00:00:00 2001
From: Pratheep Selvam <pratheepselvam@Pratheeps-MacBook-Air.local>
Date: Sat, 20 Jun 2026 22:51:25 +0530
Subject: [PATCH 2/5] fix: add permission check for allocate_leaves_manually

---
 hrms/hr/doctype/leave_allocation/leave_allocation.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hrms/hr/doctype/leave_allocation/leave_allocation.py b/hrms/hr/doctype/leave_allocation/leave_allocation.py
index 180a99d4f6..89bb02d7b1 100755
--- a/hrms/hr/doctype/leave_allocation/leave_allocation.py
+++ b/hrms/hr/doctype/leave_allocation/leave_allocation.py
@@ -353,6 +353,7 @@ def create_leave_ledger_entry(self, submit=True):
 
 	@frappe.whitelist()
 	def allocate_leaves_manually(self, new_leaves: str | float, from_date: str | datetime.date | None = None):
+		self.check_permission("write")
 		if from_date and not (getdate(self.from_date) <= getdate(from_date) <= getdate(self.to_date)):
 			frappe.throw(
 				_("Cannot allocate leaves outside the allocation period {0} - {1}").format(

From d66082a4c530bade3e7e6c48f61fd2e3af9b4c58 Mon Sep 17 00:00:00 2001
From: Raghav Ruia <raghavruia.dev@gmail.com>
Date: Tue, 16 Jun 2026 16:21:55 +0530
Subject: [PATCH 3/5] fix(pwa): preserve leave balance before application when
 viewing existing leaves

Vue reactive watchers on leave_type and from_date/to_date were firing
during initial document population in FormView.onMounted, causing
setLeaveBalance() to overwrite the stored DB value with the current
(post-deduction) balance.

Added isFormInitialized flag that blocks setLeaveBalance() until after
the first data load completes, matching the desk behaviour where
get_leave_balance is only called on explicit user interactions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 frontend/src/views/leave/Form.vue | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/frontend/src/views/leave/Form.vue b/frontend/src/views/leave/Form.vue
index ec3bf00791..2e6b710a37 100644
--- a/frontend/src/views/leave/Form.vue
+++ b/frontend/src/views/leave/Form.vue
@@ -18,7 +18,7 @@
 <script setup>
 import { IonPage, IonContent } from "@ionic/vue"
 import { createResource } from "frappe-ui"
-import { ref, watch, inject } from "vue"
+import { ref, watch, inject, nextTick } from "vue"
 
 import FormView from "@/components/FormView.vue"
 
@@ -39,6 +39,23 @@ const currEmployee = ref(sessionEmployee.data.name)
 // reactive object to store form data
 const leaveApplication = ref({})
 
+// For existing docs, watchers fire during initial data population from the DB.
+// This flag prevents setLeaveBalance() from overwriting the stored
+// "leave balance before application" value during that initial load.
+const isFormInitialized = ref(!props.id)
+if (props.id) {
+	watch(
+		() => leaveApplication.value.name,
+		(name) => {
+			if (name && !isFormInitialized.value) {
+				nextTick(() => {
+					isFormInitialized.value = true
+				})
+			}
+		}
+	)
+}
+
 // get form fields
 const formFields = createResource({
 	url: "hrms.api.get_doctype_fields",
@@ -207,6 +224,7 @@ function setTotalLeaveDays() {
 
 function setLeaveBalance() {
 	if (!areValuesSet()) return
+	if (!isFormInitialized.value) return
 
 	const leaveBalance = createResource({
 		url: "hrms.hr.doctype.leave_application.leave_application.get_leave_balance_on",

From aeeaf488a64fbb3f828d6656491bc6789d9bfe86 Mon Sep 17 00:00:00 2001
From: Asmita Hase <asmitahase@gmail.com>
Date: Mon, 22 Jun 2026 13:05:14 +0530
Subject: [PATCH 4/5] fix: remove ignore permission parameter from whiltelisted
 method

---
 .../salary_structure/salary_structure.py      | 22 +++++++++++++
 .../employee_ctc_break_up.py                  | 32 +++++++++++++++++--
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/hrms/payroll/doctype/salary_structure/salary_structure.py b/hrms/payroll/doctype/salary_structure/salary_structure.py
index a6d52d721f..39ef26d4c2 100644
--- a/hrms/payroll/doctype/salary_structure/salary_structure.py
+++ b/hrms/payroll/doctype/salary_structure/salary_structure.py
@@ -374,6 +374,28 @@ def make_salary_slip(
 	print_format: str | None = None,
 	for_preview: int = 0,
 	lwp_days_corrected: float | None = None,
+) -> str | Document:
+	return _make_salary_slip(
+		source_name,
+		target_doc=target_doc,
+		employee=employee,
+		posting_date=posting_date,
+		as_print=as_print,
+		print_format=print_format,
+		for_preview=for_preview,
+		lwp_days_corrected=lwp_days_corrected,
+	)
+
+
+def _make_salary_slip(
+	source_name: str,
+	target_doc: str | Document | None = None,
+	employee: str | None = None,
+	posting_date: str | datetime.date | None = None,
+	as_print: bool = False,
+	print_format: str | None = None,
+	for_preview: int = 0,
+	lwp_days_corrected: float | None = None,
 	ignore_permissions: bool = False,
 ) -> str | Document:
 	def postprocess(source, target):
diff --git a/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py b/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
index f92d15322d..9cab239a15 100644
--- a/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
+++ b/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
@@ -7,7 +7,7 @@
 from frappe.utils.formatters import fmt_money
 from frappe.utils.jinja import render_template
 
-from hrms.payroll.doctype.salary_structure.salary_structure import make_salary_slip
+from hrms.payroll.doctype.salary_structure.salary_structure import _make_salary_slip
 
 
 class SalaryBreakupReport:
@@ -23,7 +23,10 @@ def __init__(self, employee, salary_structure_assignment):
 			)
 		)
 		self.validate_ctc()
-		self.salary_slip = make_salary_slip(
+		# Access is already gated by validate_employee_access() in execute();
+		# bypass doctype-level permissions to build the preview on the
+		# employee's behalf (they cannot read Salary Structure directly).
+		self.salary_slip = _make_salary_slip(
 			self.salary_structure,
 			employee=self.employee,
 			for_preview=1,
@@ -313,9 +316,34 @@ def execute(filters: dict | None = None):
 			title=_("Missing value for filters"),
 		)
 
+	validate_employee_access(employee)
+
 	salary_breakup_report = SalaryBreakupReport(employee, salary_structure_assignment)
 
 	data = salary_breakup_report.get_data()
 	columns = salary_breakup_report.get_columns()
 	message = salary_breakup_report.get_message()
 	return columns, data, message, None, None
+
+
+# Roles allowed to view any employee's CTC report. Everyone else can only
+# view their own.
+CTC_REPORT_PRIVILEGED_ROLES = ("System Manager", "HR Manager", "HR User")
+
+
+def validate_employee_access(employee: str):
+	"""Restrict the report to the logged-in employee's own record.
+
+	Users holding a privileged role can view any employee's report; everyone
+	else may only view the Employee record linked to their own user account.
+	"""
+	if set(CTC_REPORT_PRIVILEGED_ROLES) & set(frappe.get_roles()):
+		return
+
+	linked_user = frappe.db.get_value("Employee", employee, "user_id")
+	if linked_user != frappe.session.user:
+		frappe.throw(
+			_("You are not permitted to access the CTC report of another employee."),
+			frappe.PermissionError,
+			title=_("Not Permitted"),
+		)

From 3133ca725e775e76a4a769f7278497beac95bfd5 Mon Sep 17 00:00:00 2001
From: Asmita Hase <asmitahase@gmail.com>
Date: Mon, 22 Jun 2026 13:40:59 +0530
Subject: [PATCH 5/5] fix: clean up

---
 .../employee_ctc_break_up.py                  | 21 +++++--------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py b/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
index 9cab239a15..fe58b558cf 100644
--- a/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
+++ b/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
@@ -3,7 +3,7 @@
 
 import frappe
 from frappe import _
-from frappe.utils import flt, get_link_to_form
+from frappe.utils import flt, get_link_to_form, has_common
 from frappe.utils.formatters import fmt_money
 from frappe.utils.jinja import render_template
 
@@ -23,9 +23,6 @@ def __init__(self, employee, salary_structure_assignment):
 			)
 		)
 		self.validate_ctc()
-		# Access is already gated by validate_employee_access() in execute();
-		# bypass doctype-level permissions to build the preview on the
-		# employee's behalf (they cannot read Salary Structure directly).
 		self.salary_slip = _make_salary_slip(
 			self.salary_structure,
 			employee=self.employee,
@@ -326,22 +323,14 @@ def execute(filters: dict | None = None):
 	return columns, data, message, None, None
 
 
-# Roles allowed to view any employee's CTC report. Everyone else can only
-# view their own.
-CTC_REPORT_PRIVILEGED_ROLES = ("System Manager", "HR Manager", "HR User")
+ROLES_ALLOWED_TO_VIEW_ANY_EMPLOYEE = ("System Manager", "HR Manager", "HR User")
 
 
 def validate_employee_access(employee: str):
-	"""Restrict the report to the logged-in employee's own record.
+	can_view_any_employee = has_common(ROLES_ALLOWED_TO_VIEW_ANY_EMPLOYEE, frappe.get_roles())
+	is_own_record = frappe.db.get_value("Employee", employee, "user_id") == frappe.session.user
 
-	Users holding a privileged role can view any employee's report; everyone
-	else may only view the Employee record linked to their own user account.
-	"""
-	if set(CTC_REPORT_PRIVILEGED_ROLES) & set(frappe.get_roles()):
-		return
-
-	linked_user = frappe.db.get_value("Employee", employee, "user_id")
-	if linked_user != frappe.session.user:
+	if not can_view_any_employee and not is_own_record:
 		frappe.throw(
 			_("You are not permitted to access the CTC report of another employee."),
 			frappe.PermissionError,