fix!: field-level permissions for agent-only ticket fields

[aerodeval]

Problem

From the portal a customer could set agent-only fields on their own ticket — priority, sla, response_by — with frappe.client.set_value, and fake raised_by, contact or customer at creation.

Fix

• Reading — permission levels on HD Ticket: 7 customer-readable, 8 agent-only. Frappe enforces them on every path, /api/resource included. 1–6 stay free for a site's own scheme.
• Editing — prevent_customer_edits() in validate. Levels can't cover this: a customer needs level-0 write just to create a ticket. They keep feedback, feedback_extra and closing the ticket.
• Per-site hiding — each Default-template row carries a Visible to select (Everyone / Customers / Agents) that hides the field on helpdesk's own pages. It only narrows what the level already allows, never widens.

Level	Fields	Customers	Agents
0	subject, status, description, template, attachment, content_type, feedback, feedback_extra, feedback_rating	fill on create, then only status (to close) and feedback	edit
7	raised_by, contact, customer, priority, ticket_type, agent_group, sla, status_category, response_by, resolution_by, on_hold_since, first_response_time, first_responded_on, first_response_failed_by, resolution_date, resolution_time, resolution_failed_by	read; fill on create if the template shows it	edit
8	key, summary, resolution_details, agreement_status, service_level_agreement_creation, opening_date, opening_time, avg_response_time, total_hold_time, user_resolution_time, raised_outside_working_hours, last_agent_response, last_customer_response, email_account, via_customer_portal, is_merged, merged_with, ticket_split_from	no access	edit

Also fixes the fallout of hiding fields: portal reply no longer reopening a ticket, the closing-email rating link, 500 on tickets with no contact, merge losing is_merged, blank list columns and filters that raised PermissionError, Default template rename, and an agent's whole-document save blanking hidden fields.

Breaking changes

• Customers can no longer edit ticket fields after creation (closing and feedback still work).
• hide_from_customer is replaced by Visible to; a patch carries old values over. Update anything reading the flag.
• Hiding a template field hides it on helpdesk pages only — raise its level in Customize Form to hide it from the REST API too.
• A non-agent creating a ticket — including a System Manager with no HD Agent record — now gets raised_by forced to their own address and via_customer_portal set. System Manager keeps full field access through the new level-7/8 perm rows.

Existing sites

harden_hd_ticket_field_permissions writes the level-7/8 perm rows (a single Custom DocPerm row makes Frappe ignore shipped perms, so a customised site would read every protected field as empty — agents too). backfill_template_field_visible_to moves old hide_from_customer values across. Both idempotent, neither writes a field's level.

Testing

118 tests in test_hd_ticket.py, 20 in test_field_visibility.py, 2 in test_hd_email_feedback.py.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 98.22888% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.91%. Comparing base (c3ae467) to head (428f0b3).
⚠️ Report is 178 commits behind head on develop.

Files with missing lines	Patch %	Lines
helpdesk/api/doc.py	68.42%	6 Missing ⚠️
helpdesk/test_utils.py	88.88%	3 Missing ⚠️
helpdesk/helpdesk/doctype/hd_ticket/api.py	95.45%	1 Missing ⚠️
helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.py	97.82%	1 Missing ⚠️
...pdesk/helpdesk/doctype/hd_ticket/test_hd_ticket.py	99.68%	1 Missing ⚠️
...k/doctype/hd_ticket_template/hd_ticket_template.py	97.87%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #3544      +/-   ##
===========================================
+ Coverage    73.76%   77.91%   +4.15%     
===========================================
  Files          148      156       +8     
  Lines        10841    12109    +1268     
===========================================
+ Hits          7997     9435    +1438     
+ Misses        2844     2674     -170     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[greptile-apps]

Confidence Score: 4/5

The repository query requirement must be satisfied before merging.

_{Reviews (41) · Last reviewed commit: "fix(perms): drop the per-user cache on g..."}

[greptile-apps]

Permission-Aware Queries Required

The new visibility lookup uses frappe.get_all(), as does customer_fillable_template_fields() in hd_ticket.py. This violates the repository directive to prefer permission-aware frappe.get_list() for new code, so the requirement must be satisfied before merging.

Context Used: AGENTS.md (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: helpdesk/field_visibility.py
Line: 54-61

Comment:
**Permission-Aware Queries Required**

The new visibility lookup uses `frappe.get_all()`, as does `customer_fillable_template_fields()` in `hd_ticket.py`. This violates the repository directive to prefer permission-aware `frappe.get_list()` for new code, so the requirement must be satisfied before merging.

**Context Used:** AGENTS.md ([source](https://github.com/frappe/helpdesk/blob/develop/AGENTS.md))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!