Job Application web form: guest 403 on frappe.client.get_value (job_title lookup in after_load)

Information about bug

Description of the issue

The Job Application web form throws a Guest permission error on load whenever it's reached via the standard "Apply Now" link from a published Job Opening (i.e. any URL with a ?job_title=<job-opening-id> query param).

Root cause: (as diagnosed by Claude AI): the web form's client_script (hrms/hr/web_form/job_application/job_application.json) runs an unconditional frappe.web_form.after_load handler that calls frappe.client.get_value to resolve the Job Opening's title for display:

​```js frappe.web_form.after_load = () => { const job_opening = frappe.utils.get_query_params().job_title; if (!job_opening) return;

frappe.call({
	method: "frappe.client.get_value",
	args: {
		doctype: "Job Opening",
		filters: job_opening,
		fieldname: "job_title",
	},
	callback: (r) => {
		if (!r?.message) return;
		const title = frappe.utils.escape_html(r.message.job_title);
		$(frappe.web_form.fields_dict["job_title"].wrapper)
			.find(".control-value")
			.text(title);
	},
});

}; ​```

frappe.client.get_value is whitelisted but not with allow_guest=True. Since anyone opening the job application form without logging in is a Guest, the call 403s with:

Method Not Allowed. You are not permitted to access this resource. Login to access. Function frappe.client.get_value is not whitelisted.

This appears to be a regression introduced by the fix for #4188 (shipped in HRMS v16.16.0 / PR #5030, "Shows the job opening's Job Title instead of its ID on the job application web form"). The feature works correctly for logged-in users but breaks for the primary intended audience: anonymous public applicants.

Impact: Non-blocking — the application still submits successfully after the error is dismissed — but every anonymous applicant sees a raw permission-error popup on page load, which is a poor first impression on a public careers page.

Another user hit the identical error independently: https://discuss.frappe.io/t/frappe-hr-hrms-jobs-page/164442 (same URL pattern, same frappe.client.get_value call, HRMS 16.17.0).

Steps to reproduce the issue

1. Publish a Job Opening on the public jobs board.
2. As a Guest (logged out / incognito), click "Apply Now" on that job opening. This lands on /job_application/new?job_title=<job-opening-id>.
3. Observe the permission-error popup on page load.
4. Dismiss it — the form still functions and can still be submitted.

Module

HR

Version

erpnext 16.34.2 frappe 16.33.1 hrms 16.18.0

Installation method

None

Relevant log output / Stack trace / Full Error Message.

Code of Conduct

• I agree to follow this project's Code of Conduct