diff --git a/spp_area/README.rst b/spp_area/README.rst index bd8dfabb..3798a92b 100644 --- a/spp_area/README.rst +++ b/spp_area/README.rst @@ -140,6 +140,14 @@ Dependencies Changelog ========= +19.0.2.0.1 +~~~~~~~~~~ + +- fix(security): grant ``group_area_viewer`` (read-only) to + spp_user_roles support roles (Global Support, Global Support Manager, + Local Support) so they can browse area records per the OP#951 menu + audit. + 19.0.2.0.0 ~~~~~~~~~~ diff --git a/spp_area/__manifest__.py b/spp_area/__manifest__.py index 29ef826e..ea8d9533 100644 --- a/spp_area/__manifest__.py +++ b/spp_area/__manifest__.py @@ -6,7 +6,7 @@ "name": "OpenSPP Area Management", "summary": "Establishes direct associations between OpenSPP registrants, beneficiary groups, and their corresponding geographical administrative areas. It validates registrant-area linkages against official area types, ensuring data integrity and enabling targeted program delivery and analysis.", "category": "OpenSPP/Core", - "version": "19.0.2.0.0", + "version": "19.0.2.0.1", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", @@ -33,6 +33,7 @@ "security/privileges.xml", "security/groups.xml", "security/ir.model.access.csv", + "data/user_roles.xml", "wizard/area_import_language_wizard_views.xml", "views/area_base.xml", "views/area_tag.xml", diff --git a/spp_area/data/user_roles.xml b/spp_area/data/user_roles.xml new file mode 100644 index 00000000..9597d31d --- /dev/null +++ b/spp_area/data/user_roles.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + diff --git a/spp_area/readme/HISTORY.md b/spp_area/readme/HISTORY.md index 4aaf9afe..618438f5 100644 --- a/spp_area/readme/HISTORY.md +++ b/spp_area/readme/HISTORY.md @@ -1,3 +1,7 @@ +### 19.0.2.0.1 + +- fix(security): grant `group_area_viewer` (read-only) to spp_user_roles support roles (Global Support, Global Support Manager, Local Support) so they can browse area records per the OP#951 menu audit. + ### 19.0.2.0.0 - Initial migration to OpenSPP2 diff --git a/spp_area/static/description/index.html b/spp_area/static/description/index.html index 131f7568..c560d902 100644 --- a/spp_area/static/description/index.html +++ b/spp_area/static/description/index.html @@ -537,6 +537,15 @@

Changelog

+

19.0.2.0.1

+ +
+

19.0.2.0.0

+

19.0.2.0.1

+ +
+

19.0.2.0.0

+

19.0.2.0.4

+ +
+

19.0.2.0.3

-
+

19.0.2.0.2

-
+

19.0.2.0.1

  • fix: skip field types before getattr and isolate detail prefetch (#129)
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_farmer_registry/README.rst b/spp_farmer_registry/README.rst index bcfad58f..8a8edce9 100644 --- a/spp_farmer_registry/README.rst +++ b/spp_farmer_registry/README.rst @@ -68,6 +68,16 @@ Model Description Changelog ========= +19.0.2.0.2 +~~~~~~~~~~ + +- fix(security): align Farm User / Farm Manager roles with the OP#951 + menu audit — both farm roles now imply + ``spp_hazard.group_hazard_viewer`` and + ``spp_gis_report.group_gis_report_user`` so they retain Hazard and GIS + Reports menu visibility once those menu roots are gated. Adds + ``spp_hazard`` and ``spp_gis_report`` to module dependencies. + 19.0.2.0.1 ~~~~~~~~~~ diff --git a/spp_farmer_registry/__manifest__.py b/spp_farmer_registry/__manifest__.py index 853f77b5..e17bfd40 100644 --- a/spp_farmer_registry/__manifest__.py +++ b/spp_farmer_registry/__manifest__.py @@ -3,7 +3,7 @@ "name": "OpenSPP Farmer Registry", "summary": "Farmer Registry with vocabulary-based fields, CEL variables, and Logic Studio integration", "category": "OpenSPP", - "version": "19.0.2.0.1", + "version": "19.0.2.0.2", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", @@ -26,6 +26,9 @@ "spp_land_record", "spp_irrigation", "spp_gis", + # OP#951 menu audit — roles get hazard / GIS reports menu access + "spp_hazard", + "spp_gis_report", ], "excludes": [ "spp_base_farmer_registry", # V1 module - incompatible _inherits definitions diff --git a/spp_farmer_registry/data/user_roles.xml b/spp_farmer_registry/data/user_roles.xml index b4dda081..5007e1a5 100644 --- a/spp_farmer_registry/data/user_roles.xml +++ b/spp_farmer_registry/data/user_roles.xml @@ -17,6 +17,8 @@ Command.link(ref('base.group_user')), Command.link(ref('group_spp_farm_user')), Command.link(ref('spp_registry.group_registry_officer')), + Command.link(ref('spp_hazard.group_hazard_viewer')), + Command.link(ref('spp_gis_report.group_gis_report_user')), ]" /> @@ -35,6 +37,8 @@ Command.link(ref('group_spp_farm_manager')), Command.link(ref('spp_irrigation.group_irrigation_manager')), Command.link(ref('spp_registry.group_registry_manager')), + Command.link(ref('spp_hazard.group_hazard_viewer')), + Command.link(ref('spp_gis_report.group_gis_report_user')), ]" /> diff --git a/spp_farmer_registry/readme/HISTORY.md b/spp_farmer_registry/readme/HISTORY.md index 6b85f6dd..e3389d0a 100644 --- a/spp_farmer_registry/readme/HISTORY.md +++ b/spp_farmer_registry/readme/HISTORY.md @@ -1,3 +1,7 @@ +### 19.0.2.0.2 + +- fix(security): align Farm User / Farm Manager roles with the OP#951 menu audit — both farm roles now imply `spp_hazard.group_hazard_viewer` and `spp_gis_report.group_gis_report_user` so they retain Hazard and GIS Reports menu visibility once those menu roots are gated. Adds `spp_hazard` and `spp_gis_report` to module dependencies. + ### 19.0.2.0.1 - fix(views): apply `spp_registry.x2many_no_padding` widget to the farm activities list on farm forms — removes the four empty placeholder rows Odoo 19 inserts on inline list-in-form views (#943). diff --git a/spp_farmer_registry/static/description/index.html b/spp_farmer_registry/static/description/index.html index 4b3f827b..02339a1f 100644 --- a/spp_farmer_registry/static/description/index.html +++ b/spp_farmer_registry/static/description/index.html @@ -436,6 +436,17 @@

    Changelog

+

19.0.2.0.2

+
    +
  • fix(security): align Farm User / Farm Manager roles with the OP#951 +menu audit — both farm roles now imply +spp_hazard.group_hazard_viewer and +spp_gis_report.group_gis_report_user so they retain Hazard and GIS +Reports menu visibility once those menu roots are gated. Adds +spp_hazard and spp_gis_report to module dependencies.
    • +
+
+

19.0.2.0.1

  • fix(views): apply spp_registry.x2many_no_padding widget to the @@ -443,7 +454,7 @@

    19.0.2.0.1

    placeholder rows Odoo 19 inserts on inline list-in-form views (#943).
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_gis_report/README.rst b/spp_gis_report/README.rst index 4c2b22e7..a4779a87 100644 --- a/spp_gis_report/README.rst +++ b/spp_gis_report/README.rst @@ -151,6 +151,20 @@ Dependencies Changelog ========= +19.0.2.0.1 +~~~~~~~~~~ + +- fix(security): grant ``group_gis_report_user`` to spp_user_roles' + Global Program Manager role so the OP#951 menu audit expectation + (Program Manager sees GIS Reports) is preserved once the GIS Reports + menu root is gated. +- fix(views): gate the "GIS Reports" top-level menu + (``menu_gis_report_root``) on ``group_gis_report_user``. Previously + visible to every logged-in user; the OP#951 audit requires several + roles to NOT see it (Registry Viewer, Global Finance, Global Support, + Global Support Manager, Local Support, Global Registrar, Local + Registrar, CR roles). + 19.0.2.0.0 ~~~~~~~~~~ diff --git a/spp_gis_report/__manifest__.py b/spp_gis_report/__manifest__.py index 8a5e6d0c..997f8197 100644 --- a/spp_gis_report/__manifest__.py +++ b/spp_gis_report/__manifest__.py @@ -1,6 +1,6 @@ { "name": "OpenSPP GIS Reports", - "version": "19.0.2.0.0", + "version": "19.0.2.0.1", "category": "OpenSPP", "summary": "Geographic visualization and reporting for social protection data", "author": "OpenSPP.org, OpenSPP", @@ -26,6 +26,7 @@ "security/ir.model.access.csv", # Data "data/gis_report_category_data.xml", + "data/user_roles.xml", "data/templates/coverage_templates.xml", "data/templates/disaster_templates.xml", "data/templates/demographic_templates.xml", diff --git a/spp_gis_report/data/user_roles.xml b/spp_gis_report/data/user_roles.xml new file mode 100644 index 00000000..f34da6eb --- /dev/null +++ b/spp_gis_report/data/user_roles.xml @@ -0,0 +1,18 @@ + + + + + + + diff --git a/spp_gis_report/readme/HISTORY.md b/spp_gis_report/readme/HISTORY.md index 4aaf9afe..d519fd50 100644 --- a/spp_gis_report/readme/HISTORY.md +++ b/spp_gis_report/readme/HISTORY.md @@ -1,3 +1,8 @@ +### 19.0.2.0.1 + +- fix(security): grant `group_gis_report_user` to spp_user_roles' Global Program Manager role so the OP#951 menu audit expectation (Program Manager sees GIS Reports) is preserved once the GIS Reports menu root is gated. +- fix(views): gate the "GIS Reports" top-level menu (`menu_gis_report_root`) on `group_gis_report_user`. Previously visible to every logged-in user; the OP#951 audit requires several roles to NOT see it (Registry Viewer, Global Finance, Global Support, Global Support Manager, Local Support, Global Registrar, Local Registrar, CR roles). + ### 19.0.2.0.0 - Initial migration to OpenSPP2 diff --git a/spp_gis_report/static/description/index.html b/spp_gis_report/static/description/index.html index 84ca57a7..19db8e2c 100644 --- a/spp_gis_report/static/description/index.html +++ b/spp_gis_report/static/description/index.html @@ -531,6 +531,21 @@

    Changelog

+

19.0.2.0.1

+
    +
  • fix(security): grant group_gis_report_user to spp_user_roles’ +Global Program Manager role so the OP#951 menu audit expectation +(Program Manager sees GIS Reports) is preserved once the GIS Reports +menu root is gated.
    • +
  • fix(views): gate the “GIS Reports” top-level menu +(menu_gis_report_root) on group_gis_report_user. Previously +visible to every logged-in user; the OP#951 audit requires several +roles to NOT see it (Registry Viewer, Global Finance, Global Support, +Global Support Manager, Local Support, Global Registrar, Local +Registrar, CR roles).
    • +
+
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_gis_report/views/menu.xml b/spp_gis_report/views/menu.xml index 93b57139..328a7489 100644 --- a/spp_gis_report/views/menu.xml +++ b/spp_gis_report/views/menu.xml @@ -11,6 +11,7 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details. name="GIS Reports" web_icon="spp_gis_report,static/description/OpenSPP-GIS-Reports-Menu-Icons.png" sequence="50" + groups="spp_gis_report.group_gis_report_user" /> diff --git a/spp_grm/README.rst b/spp_grm/README.rst index c40c98e9..d3502d33 100644 --- a/spp_grm/README.rst +++ b/spp_grm/README.rst @@ -153,6 +153,17 @@ Dependencies Changelog ========= +19.0.2.0.1 +~~~~~~~~~~ + +- fix(views): gate the "Helpdesk" top-level menu + (``spp_grm_ticket_main_menu``) on ``group_grm_viewer``. Previously the + root menu had no ``groups=`` attribute and was visible to every + logged-in user; the OP#951 menu audit requires several roles to NOT + see it (Registry Viewer, Global Finance, Global Program Manager, + Program Viewer/Validator/Cycle Approver, Global Registrar, CR roles, + Farm User/Manager). + 19.0.2.0.0 ~~~~~~~~~~ diff --git a/spp_grm/__manifest__.py b/spp_grm/__manifest__.py index f378571c..179c4300 100644 --- a/spp_grm/__manifest__.py +++ b/spp_grm/__manifest__.py @@ -3,7 +3,7 @@ { "name": "OpenSPP - Grievance Redress Mechanism", "summary": "Provides a centralized Grievance Redress Mechanism for receiving, tracking, and resolving beneficiary complaints and feedback. It supports multi-channel submission, manages resolution workflows through customizable stages, and links grievances directly to individual or group registrants.", - "version": "19.0.2.0.0", + "version": "19.0.2.0.1", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", diff --git a/spp_grm/readme/HISTORY.md b/spp_grm/readme/HISTORY.md index 4aaf9afe..ffafdb8f 100644 --- a/spp_grm/readme/HISTORY.md +++ b/spp_grm/readme/HISTORY.md @@ -1,3 +1,7 @@ +### 19.0.2.0.1 + +- fix(views): gate the "Helpdesk" top-level menu (`spp_grm_ticket_main_menu`) on `group_grm_viewer`. Previously the root menu had no `groups=` attribute and was visible to every logged-in user; the OP#951 menu audit requires several roles to NOT see it (Registry Viewer, Global Finance, Global Program Manager, Program Viewer/Validator/Cycle Approver, Global Registrar, CR roles, Farm User/Manager). + ### 19.0.2.0.0 - Initial migration to OpenSPP2 diff --git a/spp_grm/static/description/index.html b/spp_grm/static/description/index.html index 79ed528a..0d1621de 100644 --- a/spp_grm/static/description/index.html +++ b/spp_grm/static/description/index.html @@ -536,6 +536,18 @@

    Changelog

+

19.0.2.0.1

+ +
+

19.0.2.0.0

+

19.0.2.0.2

+ +
+

19.0.2.0.1

-
+

19.0.2.0.0

+

19.0.2.1.2

+ +
+

19.0.2.1.1

-
+

19.0.2.0.11

-
+

19.0.2.0.10

  • Increase parallel-safe channel limits (cycle, eligibility_manager, @@ -690,7 +709,7 @@

    19.0.2.0.10

    submission on double-click
-
+

19.0.2.0.9

  • Add context flags (skip_registrant_statistics, @@ -703,7 +722,7 @@

    19.0.2.0.9

    _compute_has_members
-
+

19.0.2.0.8

  • Replace OFFSET pagination with NTILE-based ID-range batching in all @@ -714,7 +733,7 @@

    19.0.2.0.8

    program and cycle
-
+

19.0.2.0.7

  • Bulk membership creation using raw SQL INSERT ON CONFLICT DO NOTHING @@ -723,7 +742,7 @@

    19.0.2.0.7

    _add_beneficiaries with bulk SQL path
-
+

19.0.2.0.6

  • Remove unused entitlement_base_model.py (dead code, never imported)
    • @@ -732,34 +751,34 @@

    19.0.2.0.6

    payment, and fund tests (172 → 492 tests)
-
+

19.0.2.0.5

  • Batch create entitlements and payments instead of one-by-one ORM creates
-
+

19.0.2.0.4

  • Fetch fund balance once per approval batch instead of per entitlement
-
+

19.0.2.0.3

  • Replace cycle computed fields (total_amount, entitlements_count, approval flags) with SQL aggregation queries
-
+

19.0.2.0.2

  • Add composite indexes for frequent query patterns on entitlements and program memberships
-
+

19.0.2.0.1

  • Replace Python-level uniqueness checks with SQL UNIQUE constraints for @@ -768,7 +787,7 @@

    19.0.2.0.1

    constraint creation
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_programs/static/src/js/form_controller_create.js b/spp_programs/static/src/js/form_controller_create.js index f0bc222c..2ebb31eb 100644 --- a/spp_programs/static/src/js/form_controller_create.js +++ b/spp_programs/static/src/js/form_controller_create.js @@ -5,19 +5,24 @@ import {patch} from "@web/core/utils/patch"; import {onMounted, onPatched, onWillUnmount} from "@odoo/owl"; /** - * Patch FormController to respect context.create = false and disable create - * for specific models (entitlements). + * Patch FormController to hide the form "New" button when the user lacks + * create permission, or for models where create is contextually forbidden. * - * In Odoo 19, the "New" button may still appear in various scenarios: - * - When navigating from list to form view with context.create = false - * - When expanding a dialog (creates a new action without preserving context) + * In Odoo 19, `t-if="canCreate"` on the form template does not always prevent + * the "New" button from rendering — notably the breadcrumb-area button can + * leak through when the form arch was first loaded as a privileged user and + * cached, or in some action navigation flows. This patch enforces hiding via + * DOM manipulation for: * - * This patch hides the New button via DOM manipulation for: - * 1. Any view with context.create === false - * 2. Entitlement models (should only be created from cycles) + * 1. Any view with `context.create === false`. + * 2. Models in MODELS_WITHOUT_CREATE (always-hide; never should be created + * directly from the form, e.g. entitlements). + * 3. `this.canCreate === false` — i.e. the ACL-derived archInfo.activeActions + * .create is false. This is the ACL-aware path that preserves the button + * for users who DO have create permission. */ -// Models that should never show the create button +// Models that should never show the create button regardless of ACL const MODELS_WITHOUT_CREATE = [ "spp.entitlement", "spp.entitlement.inkind", @@ -33,7 +38,8 @@ patch(FormController.prototype, { const modelName = this.props.resModel; const shouldHideCreate = this.props.context?.create === false || - MODELS_WITHOUT_CREATE.includes(modelName); + MODELS_WITHOUT_CREATE.includes(modelName) || + this.canCreate === false; if (shouldHideCreate) { this._hideCreateObserver = null; diff --git a/spp_programs/views/cycle_compliance_view.xml b/spp_programs/views/cycle_compliance_view.xml index 847fd2d2..cfd55912 100644 --- a/spp_programs/views/cycle_compliance_view.xml +++ b/spp_programs/views/cycle_compliance_view.xml @@ -18,6 +18,7 @@ class="btn-warning" confirm="Filtering is a one-way action. Are you sure you want to apply compliance criteria?" invisible="not allow_filter_compliance_criteria or compliance_criteria_applied" + groups="spp_programs.group_programs_manager" /> diff --git a/spp_programs/views/cycle_view.xml b/spp_programs/views/cycle_view.xml index c4a7cae4..f21d98cb 100644 --- a/spp_programs/views/cycle_view.xml +++ b/spp_programs/views/cycle_view.xml @@ -134,7 +134,7 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details. string="Copy Beneficiaries" icon="fa-copy" invisible="state != 'draft'" - groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator" + groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer" /> - +
+

19.0.2.0.2

+
    +
  • fix(security): grant group_service_points_viewer to +spp_user_roles’ Global Registrar and Local Registrar roles so they can +browse service points per the OP#951 menu audit.
    • +
+
+

19.0.2.0.1

  • fix(views): apply spp_registry.x2many_no_padding widget to the @@ -524,7 +532,7 @@

    19.0.2.0.1

    placeholder rows Odoo 19 inserts on inline list-in-form views (#943).
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_service_points/views/service_points_view.xml b/spp_service_points/views/service_points_view.xml index ca574200..a9399f30 100644 --- a/spp_service_points/views/service_points_view.xml +++ b/spp_service_points/views/service_points_view.xml @@ -51,6 +51,7 @@ string="Enable Service Point" class="btn-success" invisible="not is_disabled or not id" + groups="spp_service_points.group_service_points_officer,spp_service_points.group_service_points_manager" confirm="Enable this service point? It will become active again." />
+

19.0.2.0.1

+
    +
  • fix(security): drop the Program Manager → group_studio_viewer +extension per the OP#951 menu audit (Program Manager should NOT see +the Studio top-level menu). Removes data/user_roles.xml from the +module entirely; System Admin retains Studio visibility via +spp_security.group_spp_admin → group_studio_manager (wired in +spp_studio/security/groups.xml).
    • +
+
+

19.0.2.0.0

  • Initial migration to OpenSPP2