[pull]

See Commits and Changes for more details.

---

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

Greptile Summary

This PR syncs upstream InvenTree changes that introduce two main features: (1) inline "create new" buttons on related-model fields (supplier, customer, manufacturer, parameter template) so users can create records without leaving the form, and (2) a plugin escape-hatch in the backend permission system via a check_user_permission classmethod on plugin-defined models. It also fixes a rules-of-hooks violation by converting InlineCreateButton from a plain function to a proper React component.

Confidence Score: 5/5

Safe to merge; remaining findings are P2 style/robustness suggestions that do not block functionality.

All identified issues are P2: one style concern about non-reactive Zustand state access and one hardening suggestion for exception handling in the plugin permission fallback. Neither causes incorrect behavior under normal conditions, and the core feature additions are well-structured with new test coverage.

No files require special attention beyond the two inline P2 comments.

Important Files Changed

Filename	Overview
src/backend/InvenTree/users/permissions.py	Adds a fallback to a model-defined check_user_permission classmethod for plugin models not covered by the standard ruleset; result is cached but the call is unguarded against plugin exceptions.
src/frontend/src/components/forms/fields/RelatedModelField.tsx	Refactors InlineCreateButton from a plain function (invalid hooks usage) to a proper React component with props, fixing a rules-of-hooks violation; also renames setValuefromPK to setValueFromPK.
src/frontend/src/forms/CommonForms.tsx	Extracts useParameterTemplateFields hook for reuse and adds inline supplier creation for the template field (staff only), but uses useUserState.getState() non-reactively inside the hook.
src/frontend/src/forms/CompanyForms.tsx	Adds addCreateFields to supplier and manufacturer related fields, enabling inline creation of companies with pre-set is_supplier/is_manufacturer flags.
src/frontend/src/forms/PurchaseOrderForms.tsx	Adds addCreateFields to the supplier field on purchase order forms for inline supplier creation.
src/frontend/src/forms/SalesOrderForms.tsx	Adds addCreateFields to the customer field on sales order forms for inline customer creation.
src/frontend/src/tables/general/ParameterTemplateTable.tsx	Replaces inline useMemo field definition with the newly extracted useParameterTemplateFields hook for DRY reuse.
src/frontend/tests/pages/pui_purchasing.spec.ts	Updates the purchasing parameters test to use stevenuser (staff) and adds coverage for the new inline parameter-template creation button.
docs/docs/plugins/mixins/app.md	Documents the new check_user_permission classmethod API for plugin-defined models, including a code example and a warning about the default-deny behaviour.
src/frontend/lib/types/Forms.tsx	JSDoc-only update to ApiFormFieldType: adds entries for modelRenderer, child/children, addCreateFields, read_only, headers, and adjustValue, and removes the obsolete onKeyDown entry.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[check_user_permission called] --> B{User active & not None?}
    B -- No --> Z[Return False]
    B -- Yes --> C{Superuser?}
    C -- Yes --> Y[Return True]
    C -- No --> D{Table in ruleset ignore list?}
    D -- Yes --> Y
    D -- No --> E{Table in ruleset models?}
    E -- Yes --> F{check_user_role passes?}
    F -- Yes --> Y
    F -- No --> G[Check RULESET_CHANGE_INHERIT]
    G --> H[Generate permission_name]
    E -- No --> H
    H --> I{Session cache hit?}
    I -- Yes --> X[Return cached result]
    I -- No --> J[user.has_perm permission_name]
    J --> K{result is False?}
    K -- No --> L[Cache & Return True]
    K -- Yes --> M{model has check_user_permission?}
    M -- No --> N[Cache False & Return False]
    M -- Yes --> O[Call model.check_user_permission]
    O --> P[Cache result & Return]

Loading

Comments Outside Diff (2)

1. src/backend/InvenTree/users/permissions.py, line 200-201 (link)

   No error handling around plugin check_user_permission call

   If a plugin's check_user_permission implementation raises an exception (e.g., a query error or programming bug in the plugin), the exception will propagate out of the standard permission check, potentially breaking permission enforcement for all callers. A bare try/except that falls back to False would isolate plugin faults.

2. src/frontend/src/forms/CommonForms.tsx, line 129 (link)

   useUserState.getState() used inside a hook instead of the reactive hook form

   useUserState.getState() returns a one-time snapshot and does not subscribe the component to future user-state changes. If the user's isStaff status were to change during the session, the addCreateFields value inside the useMemo would remain stale until the component unmounts and remounts. The standard Zustand hook call useUserState() correctly re-renders on state changes.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: src/backend/InvenTree/users/permissions.py
Line: 200-201

Comment:
**No error handling around plugin `check_user_permission` call**

If a plugin's `check_user_permission` implementation raises an exception (e.g., a query error or programming bug in the plugin), the exception will propagate out of the standard permission check, potentially breaking permission enforcement for all callers. A bare `try/except` that falls back to `False` would isolate plugin faults.

```suggestion
    if not result and hasattr(model, 'check_user_permission'):  # pragma: no cover
        try:
            result = model.check_user_permission(user, permission)
        except Exception:
            result = False
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/frontend/src/forms/CommonForms.tsx
Line: 129

Comment:
**`useUserState.getState()` used inside a hook instead of the reactive hook form**

`useUserState.getState()` returns a one-time snapshot and does not subscribe the component to future user-state changes. If the user's `isStaff` status were to change during the session, the `addCreateFields` value inside the `useMemo` would remain stale until the component unmounts and remounts. The standard Zustand hook call `useUserState()` correctly re-renders on state changes.

```suggestion
  const user = useUserState();
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "[UI] More sub-forms (#11785)" | Re-trigger Greptile}