feat(proposals): speakers can see and edit their talk proposals

[harshtandiya]

Problem

Guest form submissions store submitted_by (and owner) as Guest. The dashboard listed proposals by submitted_by = session.user, and the if_owner DocPerm restricted reads to owner = user — so speakers who submitted as guest and created an account later could never see or edit their proposals, even though their email is right there in the speakers child table.

Fix

Visibility now derives from the speakers child table (any listed speaker email), plus submitter/owner:

• Row-level access via hooks — permission_query_conditions scopes list queries, has_permission guards single-document read/write. System Manager / Event Manager stay unrestricted. Replaces the if_owner restriction on Buzz User (which hooks cannot override and which blocked guest-owned docs).
• buzz.api.proposals.get_my_proposals — typed (pydantic) endpoint returning proposals where the session user is submitter or listed speaker, so the dashboard tab stays personal even for managers who can read everything.
• ProposalsList.vue — swaps useList + submitted_by filter for the new API.

Tests

TDD — 10 new integration tests (test_talk_proposal.py, test_proposals.py) covering speaker read/write/list on guest-submitted proposals, submitter-without-speaker-row, non-speaker denial, and manager access. buzz.api.test_forms still green.

Note: speaker emails are self-reported on guest forms, so anyone listed as speaker gains view/edit on that proposal — same trust level as the form itself, flagged as a conscious call.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR lets registered speakers view and edit talk proposals submitted as guests. The main changes are:

• Adds proposal list and document permission hooks based on submitter, owner, speaker email, and manager roles.
• Adds a typed endpoint for proposals associated with the current user.
• Updates the dashboard to use the new endpoint and a user-scoped cache key.
• Adds integration tests for speaker, submitter, manager, unrelated-user, and mixed-case email access.

Confidence Score: 5/5

This looks safe to merge.

• The proposal cache now includes the current session user.
• Mixed-case speaker access is covered across document and list permissions.
• The personal-proposals endpoint covers speaker, submitter, and unrelated-user cases.
• No blocking issues were found in the updated code.

Important Files Changed

Filename	Overview
buzz/proposals/doctype/talk_proposal/talk_proposal.py	Adds query and document permission checks for submitters, owners, speakers, and managers.
buzz/api/proposals.py	Adds a typed endpoint returning proposals submitted by or associated with the current user.
buzz/hooks.py	Registers the new Talk Proposal permission hooks.
dashboard/src/pages/ProposalsList.vue	Uses the personal-proposals endpoint and scopes its resource cache by session user.
dashboard/src/pages/Account.vue	Makes the Talk Proposals tab available without a submitter-only precheck.
buzz/proposals/doctype/talk_proposal/test_talk_proposal.py	Adds permission tests for speakers, submitters, managers, unrelated users, and mixed-case emails.
buzz/api/test_proposals.py	Adds endpoint tests for proposal visibility and response shape.

_{Reviews (4): Last reviewed commit: "Merge branch 'develop' into feat/speaker..." | Re-trigger Greptile}

[harshtandiya]

Review findings actioned in 2b9f5c3:

• Cache lacks user scope — fixed, cache key is ["proposals-list", session.user] again.
• Email case blocks speaker access — confirmed real for the doc-level check (User emails are stored lowercase, guest-entered speaker emails keep their casing; the Python comparison was case-sensitive). Fixed with case-insensitive match + regression test. The SQL side already matched via MariaDB's ci collation — proven by the new test's get_list assertion.
• Empty speaker set reaches IN filter — not reproducible: test_excludes_unrelated_proposals runs exactly this path (user with zero Proposal Speaker rows) and passes; Frappe's query builder handles empty in-lists. Skipping the guard.

🤖 Generated with Claude Code

[github-actions]

Backport branch created but failed to create PR.
Request to create PR rejected with status 403.

(see action log for full response)

[github-actions]

Successfully created backport PR for main:

• feat(proposals): speakers can see and edit their talk proposals #276