diff --git a/spp_area/README.rst b/spp_area/README.rst index d186bc1c..77d6f57b 100644 --- a/spp_area/README.rst +++ b/spp_area/README.rst @@ -140,6 +140,14 @@ Dependencies Changelog ========= +19.0.2.0.2 +~~~~~~~~~~ + +- fix(security): grant ``group_area_viewer`` (read-only) to + spp_user_roles support roles (Global Support, Global Support Manager, + Local Support) so they can browse area records per the OP#951 menu + audit. + 19.0.2.0.1 ~~~~~~~~~~ diff --git a/spp_area/__manifest__.py b/spp_area/__manifest__.py index 2a50339b..3c1b88c7 100644 --- a/spp_area/__manifest__.py +++ b/spp_area/__manifest__.py @@ -6,7 +6,7 @@ "name": "OpenSPP Area Management", "summary": "Establishes direct associations between OpenSPP registrants, beneficiary groups, and their corresponding geographical administrative areas. It validates registrant-area linkages against official area types, ensuring data integrity and enabling targeted program delivery and analysis.", "category": "OpenSPP/Core", - "version": "19.0.2.0.1", + "version": "19.0.2.0.2", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", @@ -33,6 +33,7 @@ "security/privileges.xml", "security/groups.xml", "security/ir.model.access.csv", + "data/user_roles.xml", "security/rules.xml", "wizard/area_import_language_wizard_views.xml", "views/area_base.xml", diff --git a/spp_area/data/user_roles.xml b/spp_area/data/user_roles.xml new file mode 100644 index 00000000..9597d31d --- /dev/null +++ b/spp_area/data/user_roles.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + diff --git a/spp_area/readme/HISTORY.md b/spp_area/readme/HISTORY.md index 73e6d978..6cf249b0 100644 --- a/spp_area/readme/HISTORY.md +++ b/spp_area/readme/HISTORY.md @@ -1,3 +1,7 @@ +### 19.0.2.0.2 + +- fix(security): grant `group_area_viewer` (read-only) to spp_user_roles support roles (Global Support, Global Support Manager, Local Support) so they can browse area records per the OP#951 menu audit. + ### 19.0.2.0.1 - fix(security): add a global `ir.rule` on `res.partner` that filters registrants by `area_id` for users with `center_area_ids` set (OP#989). Replaces the limited `search_read` / `web_search_read` override in `models/registrant.py` which missed `name_search` (Many2one dropdowns), `search_count`, `read_group`, and related-field traversal. The rule's conditional domain is a no-op for users without center areas (global roles). diff --git a/spp_area/static/description/index.html b/spp_area/static/description/index.html index 1505db84..a75ab150 100644 --- a/spp_area/static/description/index.html +++ b/spp_area/static/description/index.html @@ -537,6 +537,15 @@

Changelog

+

19.0.2.0.2

+ +
+

19.0.2.0.1

-
+

19.0.2.0.0

+

19.0.2.0.1

+ +
+

19.0.2.0.0

+

19.0.2.0.7

+ +
+

19.0.2.0.6

-
+

19.0.2.0.5

-
+

19.0.2.0.3

  • fix: add HTML escaping to all computed Html fields with sanitize=False to prevent stored XSS (#50)
-
+

19.0.2.0.2

  • fix: fix batch approval wizard line deletion (#130)
-
+

19.0.2.0.1

  • fix: skip field types before getattr and isolate detail prefetch (#129)
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_farmer_registry/README.rst b/spp_farmer_registry/README.rst index bcfad58f..8a8edce9 100644 --- a/spp_farmer_registry/README.rst +++ b/spp_farmer_registry/README.rst @@ -68,6 +68,16 @@ Model Description Changelog ========= +19.0.2.0.2 +~~~~~~~~~~ + +- fix(security): align Farm User / Farm Manager roles with the OP#951 + menu audit — both farm roles now imply + ``spp_hazard.group_hazard_viewer`` and + ``spp_gis_report.group_gis_report_user`` so they retain Hazard and GIS + Reports menu visibility once those menu roots are gated. Adds + ``spp_hazard`` and ``spp_gis_report`` to module dependencies. + 19.0.2.0.1 ~~~~~~~~~~ diff --git a/spp_farmer_registry/__manifest__.py b/spp_farmer_registry/__manifest__.py index 853f77b5..e17bfd40 100644 --- a/spp_farmer_registry/__manifest__.py +++ b/spp_farmer_registry/__manifest__.py @@ -3,7 +3,7 @@ "name": "OpenSPP Farmer Registry", "summary": "Farmer Registry with vocabulary-based fields, CEL variables, and Logic Studio integration", "category": "OpenSPP", - "version": "19.0.2.0.1", + "version": "19.0.2.0.2", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", @@ -26,6 +26,9 @@ "spp_land_record", "spp_irrigation", "spp_gis", + # OP#951 menu audit — roles get hazard / GIS reports menu access + "spp_hazard", + "spp_gis_report", ], "excludes": [ "spp_base_farmer_registry", # V1 module - incompatible _inherits definitions diff --git a/spp_farmer_registry/data/user_roles.xml b/spp_farmer_registry/data/user_roles.xml index b4dda081..5007e1a5 100644 --- a/spp_farmer_registry/data/user_roles.xml +++ b/spp_farmer_registry/data/user_roles.xml @@ -17,6 +17,8 @@ Command.link(ref('base.group_user')), Command.link(ref('group_spp_farm_user')), Command.link(ref('spp_registry.group_registry_officer')), + Command.link(ref('spp_hazard.group_hazard_viewer')), + Command.link(ref('spp_gis_report.group_gis_report_user')), ]" /> @@ -35,6 +37,8 @@ Command.link(ref('group_spp_farm_manager')), Command.link(ref('spp_irrigation.group_irrigation_manager')), Command.link(ref('spp_registry.group_registry_manager')), + Command.link(ref('spp_hazard.group_hazard_viewer')), + Command.link(ref('spp_gis_report.group_gis_report_user')), ]" /> diff --git a/spp_farmer_registry/readme/HISTORY.md b/spp_farmer_registry/readme/HISTORY.md index 6b85f6dd..e3389d0a 100644 --- a/spp_farmer_registry/readme/HISTORY.md +++ b/spp_farmer_registry/readme/HISTORY.md @@ -1,3 +1,7 @@ +### 19.0.2.0.2 + +- fix(security): align Farm User / Farm Manager roles with the OP#951 menu audit — both farm roles now imply `spp_hazard.group_hazard_viewer` and `spp_gis_report.group_gis_report_user` so they retain Hazard and GIS Reports menu visibility once those menu roots are gated. Adds `spp_hazard` and `spp_gis_report` to module dependencies. + ### 19.0.2.0.1 - fix(views): apply `spp_registry.x2many_no_padding` widget to the farm activities list on farm forms — removes the four empty placeholder rows Odoo 19 inserts on inline list-in-form views (#943). diff --git a/spp_farmer_registry/static/description/index.html b/spp_farmer_registry/static/description/index.html index 4b3f827b..02339a1f 100644 --- a/spp_farmer_registry/static/description/index.html +++ b/spp_farmer_registry/static/description/index.html @@ -436,6 +436,17 @@

    Changelog

+

19.0.2.0.2

+
    +
  • fix(security): align Farm User / Farm Manager roles with the OP#951 +menu audit — both farm roles now imply +spp_hazard.group_hazard_viewer and +spp_gis_report.group_gis_report_user so they retain Hazard and GIS +Reports menu visibility once those menu roots are gated. Adds +spp_hazard and spp_gis_report to module dependencies.
    • +
+
+

19.0.2.0.1

  • fix(views): apply spp_registry.x2many_no_padding widget to the @@ -443,7 +454,7 @@

    19.0.2.0.1

    placeholder rows Odoo 19 inserts on inline list-in-form views (#943).
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_gis_report/README.rst b/spp_gis_report/README.rst index 4c2b22e7..a4779a87 100644 --- a/spp_gis_report/README.rst +++ b/spp_gis_report/README.rst @@ -151,6 +151,20 @@ Dependencies Changelog ========= +19.0.2.0.1 +~~~~~~~~~~ + +- fix(security): grant ``group_gis_report_user`` to spp_user_roles' + Global Program Manager role so the OP#951 menu audit expectation + (Program Manager sees GIS Reports) is preserved once the GIS Reports + menu root is gated. +- fix(views): gate the "GIS Reports" top-level menu + (``menu_gis_report_root``) on ``group_gis_report_user``. Previously + visible to every logged-in user; the OP#951 audit requires several + roles to NOT see it (Registry Viewer, Global Finance, Global Support, + Global Support Manager, Local Support, Global Registrar, Local + Registrar, CR roles). + 19.0.2.0.0 ~~~~~~~~~~ diff --git a/spp_gis_report/__manifest__.py b/spp_gis_report/__manifest__.py index 8a5e6d0c..997f8197 100644 --- a/spp_gis_report/__manifest__.py +++ b/spp_gis_report/__manifest__.py @@ -1,6 +1,6 @@ { "name": "OpenSPP GIS Reports", - "version": "19.0.2.0.0", + "version": "19.0.2.0.1", "category": "OpenSPP", "summary": "Geographic visualization and reporting for social protection data", "author": "OpenSPP.org, OpenSPP", @@ -26,6 +26,7 @@ "security/ir.model.access.csv", # Data "data/gis_report_category_data.xml", + "data/user_roles.xml", "data/templates/coverage_templates.xml", "data/templates/disaster_templates.xml", "data/templates/demographic_templates.xml", diff --git a/spp_gis_report/data/user_roles.xml b/spp_gis_report/data/user_roles.xml new file mode 100644 index 00000000..f34da6eb --- /dev/null +++ b/spp_gis_report/data/user_roles.xml @@ -0,0 +1,18 @@ + + + + + + + diff --git a/spp_gis_report/readme/HISTORY.md b/spp_gis_report/readme/HISTORY.md index 4aaf9afe..d519fd50 100644 --- a/spp_gis_report/readme/HISTORY.md +++ b/spp_gis_report/readme/HISTORY.md @@ -1,3 +1,8 @@ +### 19.0.2.0.1 + +- fix(security): grant `group_gis_report_user` to spp_user_roles' Global Program Manager role so the OP#951 menu audit expectation (Program Manager sees GIS Reports) is preserved once the GIS Reports menu root is gated. +- fix(views): gate the "GIS Reports" top-level menu (`menu_gis_report_root`) on `group_gis_report_user`. Previously visible to every logged-in user; the OP#951 audit requires several roles to NOT see it (Registry Viewer, Global Finance, Global Support, Global Support Manager, Local Support, Global Registrar, Local Registrar, CR roles). + ### 19.0.2.0.0 - Initial migration to OpenSPP2 diff --git a/spp_gis_report/static/description/index.html b/spp_gis_report/static/description/index.html index 84ca57a7..19db8e2c 100644 --- a/spp_gis_report/static/description/index.html +++ b/spp_gis_report/static/description/index.html @@ -531,6 +531,21 @@

    Changelog

+

19.0.2.0.1

+
    +
  • fix(security): grant group_gis_report_user to spp_user_roles’ +Global Program Manager role so the OP#951 menu audit expectation +(Program Manager sees GIS Reports) is preserved once the GIS Reports +menu root is gated.
    • +
  • fix(views): gate the “GIS Reports” top-level menu +(menu_gis_report_root) on group_gis_report_user. Previously +visible to every logged-in user; the OP#951 audit requires several +roles to NOT see it (Registry Viewer, Global Finance, Global Support, +Global Support Manager, Local Support, Global Registrar, Local +Registrar, CR roles).
    • +
+
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_gis_report/views/menu.xml b/spp_gis_report/views/menu.xml index 93b57139..328a7489 100644 --- a/spp_gis_report/views/menu.xml +++ b/spp_gis_report/views/menu.xml @@ -11,6 +11,7 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details. name="GIS Reports" web_icon="spp_gis_report,static/description/OpenSPP-GIS-Reports-Menu-Icons.png" sequence="50" + groups="spp_gis_report.group_gis_report_user" /> diff --git a/spp_grm/README.rst b/spp_grm/README.rst index c40c98e9..d3502d33 100644 --- a/spp_grm/README.rst +++ b/spp_grm/README.rst @@ -153,6 +153,17 @@ Dependencies Changelog ========= +19.0.2.0.1 +~~~~~~~~~~ + +- fix(views): gate the "Helpdesk" top-level menu + (``spp_grm_ticket_main_menu``) on ``group_grm_viewer``. Previously the + root menu had no ``groups=`` attribute and was visible to every + logged-in user; the OP#951 menu audit requires several roles to NOT + see it (Registry Viewer, Global Finance, Global Program Manager, + Program Viewer/Validator/Cycle Approver, Global Registrar, CR roles, + Farm User/Manager). + 19.0.2.0.0 ~~~~~~~~~~ diff --git a/spp_grm/__manifest__.py b/spp_grm/__manifest__.py index f378571c..179c4300 100644 --- a/spp_grm/__manifest__.py +++ b/spp_grm/__manifest__.py @@ -3,7 +3,7 @@ { "name": "OpenSPP - Grievance Redress Mechanism", "summary": "Provides a centralized Grievance Redress Mechanism for receiving, tracking, and resolving beneficiary complaints and feedback. It supports multi-channel submission, manages resolution workflows through customizable stages, and links grievances directly to individual or group registrants.", - "version": "19.0.2.0.0", + "version": "19.0.2.0.1", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", diff --git a/spp_grm/readme/HISTORY.md b/spp_grm/readme/HISTORY.md index 4aaf9afe..ffafdb8f 100644 --- a/spp_grm/readme/HISTORY.md +++ b/spp_grm/readme/HISTORY.md @@ -1,3 +1,7 @@ +### 19.0.2.0.1 + +- fix(views): gate the "Helpdesk" top-level menu (`spp_grm_ticket_main_menu`) on `group_grm_viewer`. Previously the root menu had no `groups=` attribute and was visible to every logged-in user; the OP#951 menu audit requires several roles to NOT see it (Registry Viewer, Global Finance, Global Program Manager, Program Viewer/Validator/Cycle Approver, Global Registrar, CR roles, Farm User/Manager). + ### 19.0.2.0.0 - Initial migration to OpenSPP2 diff --git a/spp_grm/static/description/index.html b/spp_grm/static/description/index.html index 79ed528a..0d1621de 100644 --- a/spp_grm/static/description/index.html +++ b/spp_grm/static/description/index.html @@ -536,6 +536,18 @@

    Changelog

+

19.0.2.0.1

+
    +
  • fix(views): gate the “Helpdesk” top-level menu +(spp_grm_ticket_main_menu) on group_grm_viewer. Previously the +root menu had no groups= attribute and was visible to every +logged-in user; the OP#951 menu audit requires several roles to NOT +see it (Registry Viewer, Global Finance, Global Program Manager, +Program Viewer/Validator/Cycle Approver, Global Registrar, CR roles, +Farm User/Manager).
    • +
+
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_grm/views/grm_ticket_menu.xml b/spp_grm/views/grm_ticket_menu.xml index 6dc40e4c..3a629d00 100644 --- a/spp_grm/views/grm_ticket_menu.xml +++ b/spp_grm/views/grm_ticket_menu.xml @@ -6,6 +6,7 @@ name="Helpdesk" sequence="16" web_icon="spp_grm,static/description/OpenSPP-Helpdesk2-Icons.png" + groups="spp_grm.group_grm_viewer" /> + + + + + + + + + + + + + + + diff --git a/spp_hazard/readme/HISTORY.md b/spp_hazard/readme/HISTORY.md index a1e8dfe4..c02593c5 100644 --- a/spp_hazard/readme/HISTORY.md +++ b/spp_hazard/readme/HISTORY.md @@ -1,3 +1,8 @@ +### 19.0.2.0.2 + +- fix(security): grant `group_hazard_viewer` to spp_user_roles roles (Registry Viewer, Program Manager, Global/Local Registrar) that the OP#951 menu audit identifies as needing read-only Hazard menu access. Other affected roles defined outside this module (program/CR/farm roles) are wired in their own modules. +- fix(views): gate the "Hazard and Emergency" top-level menu (`hazard_main_menu_root`) on `group_hazard_viewer`. Previously the root menu had no `groups=` attribute and was visible to every logged-in user; the OP#951 audit requires several roles to NOT see it (Global Finance, Global Support, Global Support Manager, Local Support). + ### 19.0.2.0.1 - fix(views): apply `spp_registry.x2many_no_padding` widget to the hazard impacts list on registrant forms, and hide the table when empty (showing a muted info line instead) (#943). diff --git a/spp_hazard/static/description/index.html b/spp_hazard/static/description/index.html index 42c0a996..e6eb4f50 100644 --- a/spp_hazard/static/description/index.html +++ b/spp_hazard/static/description/index.html @@ -2455,6 +2455,22 @@

    Changelog

+

19.0.2.0.2

+
    +
  • fix(security): grant group_hazard_viewer to spp_user_roles roles +(Registry Viewer, Program Manager, Global/Local Registrar) that the +OP#951 menu audit identifies as needing read-only Hazard menu access. +Other affected roles defined outside this module (program/CR/farm +roles) are wired in their own modules.
    • +
  • fix(views): gate the “Hazard and Emergency” top-level menu +(hazard_main_menu_root) on group_hazard_viewer. Previously the +root menu had no groups= attribute and was visible to every +logged-in user; the OP#951 audit requires several roles to NOT see it +(Global Finance, Global Support, Global Support Manager, Local +Support).
    • +
+
+

19.0.2.0.1

  • fix(views): apply spp_registry.x2many_no_padding widget to the @@ -2462,7 +2478,7 @@

    19.0.2.0.1

    (showing a muted info line instead) (#943).
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_hazard/views/menu.xml b/spp_hazard/views/menu.xml index 2d93f526..fc5e6b5c 100644 --- a/spp_hazard/views/menu.xml +++ b/spp_hazard/views/menu.xml @@ -6,6 +6,7 @@ name="Hazard and Emergency" web_icon="spp_hazard,static/description/OpenSPP-Web-Menu_Hazard__Emergency_Icon.png" sequence="45" + groups="spp_hazard.group_hazard_viewer" /> diff --git a/spp_programs/README.rst b/spp_programs/README.rst index b0c117bf..c05dac42 100644 --- a/spp_programs/README.rst +++ b/spp_programs/README.rst @@ -254,6 +254,24 @@ Dependencies Changelog ========= +19.0.2.1.3 +~~~~~~~~~~ + +- fix(security): align Program Viewer / Validator / Cycle Approver roles + with the OP#951 menu audit — Program Viewer additionally gets + ``group_registry_viewer`` + ``group_approval_viewer`` (read-only + Registry + Approvals access); all three program roles get + ``group_hazard_viewer`` + ``group_gis_report_user`` so they retain + Hazard / GIS Reports visibility once those menu roots are gated. Adds + ``spp_hazard`` and ``spp_gis_report`` to module dependencies. +- fix(security): hide the Registry top-level menu for Global Program + Cycle Approver per the OP#951 audit. Swap Tier-2 + ``spp_registry.group_registry_viewer`` (which gates the Registry menu) + for Tier-3 ``spp_registry.group_registry_write`` (ACL-only, no menu). + ``group_registry_write`` transitively implies ``group_registry_read``, + so the role keeps read+write access to registrant data via Programs + cross-references — only the dedicated top-level menu disappears. + 19.0.2.1.2 ~~~~~~~~~~ diff --git a/spp_programs/__manifest__.py b/spp_programs/__manifest__.py index 1e5f41a1..60580a9f 100644 --- a/spp_programs/__manifest__.py +++ b/spp_programs/__manifest__.py @@ -4,7 +4,7 @@ "name": "OpenSPP Programs", "summary": "Manage programs, cycles, beneficiary enrollment, entitlements (cash and in-kind), payments, and fund tracking for social protection.", "category": "OpenSPP/Core", - "version": "19.0.2.1.2", + "version": "19.0.2.1.3", "sequence": 1, "author": "OpenSPP.org", "website": "https://github.com/OpenSPP/OpenSPP2", @@ -27,6 +27,8 @@ "spp_user_roles", "spp_base_common", "spp_approval", + "spp_hazard", + "spp_gis_report", # CEL core libraries for expression-based managers "spp_cel_domain", "spp_cel_widget", diff --git a/spp_programs/data/user_roles.xml b/spp_programs/data/user_roles.xml index 66b6df1a..2dd46be0 100644 --- a/spp_programs/data/user_roles.xml +++ b/spp_programs/data/user_roles.xml @@ -12,6 +12,10 @@ eval="[ Command.link(ref('base.group_user')), Command.link(ref('group_programs_viewer')), + Command.link(ref('spp_registry.group_registry_viewer')), + Command.link(ref('spp_approval.group_approval_viewer')), + Command.link(ref('spp_hazard.group_hazard_viewer')), + Command.link(ref('spp_gis_report.group_gis_report_user')), ]" /> @@ -43,12 +47,18 @@ + @@ -68,11 +78,24 @@ Command.link(ref('spp_registry.group_registry_viewer')), Command.link(ref('spp_registry.group_registry_write')), Command.link(ref('spp_approval.group_approval_approver')), + Command.link(ref('spp_hazard.group_hazard_viewer')), + Command.link(ref('spp_gis_report.group_gis_report_user')), ]" /> + Global Program Cycle Approver global @@ -84,9 +107,10 @@ Command.link(ref('base.group_user')), Command.link(ref('spp_programs.group_programs_cycle_approver')), Command.link(ref('spp_programs.group_programs_viewer')), - Command.link(ref('spp_registry.group_registry_viewer')), Command.link(ref('spp_registry.group_registry_write')), Command.link(ref('spp_approval.group_approval_approver')), + Command.link(ref('spp_hazard.group_hazard_viewer')), + Command.link(ref('spp_gis_report.group_gis_report_user')), ]" /> diff --git a/spp_programs/readme/HISTORY.md b/spp_programs/readme/HISTORY.md index f04b5b84..826b3233 100644 --- a/spp_programs/readme/HISTORY.md +++ b/spp_programs/readme/HISTORY.md @@ -1,3 +1,8 @@ +### 19.0.2.1.3 + +- fix(security): align Program Viewer / Validator / Cycle Approver roles with the OP#951 menu audit — Program Viewer additionally gets `group_registry_viewer` + `group_approval_viewer` (read-only Registry + Approvals access); all three program roles get `group_hazard_viewer` + `group_gis_report_user` so they retain Hazard / GIS Reports visibility once those menu roots are gated. Adds `spp_hazard` and `spp_gis_report` to module dependencies. +- fix(security): hide the Registry top-level menu for Global Program Cycle Approver per the OP#951 audit. Swap Tier-2 `spp_registry.group_registry_viewer` (which gates the Registry menu) for Tier-3 `spp_registry.group_registry_write` (ACL-only, no menu). `group_registry_write` transitively implies `group_registry_read`, so the role keeps read+write access to registrant data via Programs cross-references — only the dedicated top-level menu disappears. + ### 19.0.2.1.2 - fix(security): add global `ir.rule` records on `spp.program.membership` and `spp.cycle.membership` that filter by `partner_id.area_id` against the user's `center_area_ids` (OP#989 round-2). The earlier Python `_prepare_domain` override on program memberships only caught `search_read` / `web_search_read` and missed counts (`search_count`, `read_group`), dropdowns (`name_search`), and related-field traversal — and cycle memberships had no filter at all. Both rules use a conditional domain that's a no-op for users with no center areas (global roles). diff --git a/spp_programs/security/ir.model.access.csv b/spp_programs/security/ir.model.access.csv index c4f38ed0..a1c5cb16 100644 --- a/spp_programs/security/ir.model.access.csv +++ b/spp_programs/security/ir.model.access.csv @@ -107,6 +107,8 @@ access_spp_program_membership_registry_read,Program Membership Registry Read Acc access_spp_program_membership_registry_write,Program Membership Registry Write Access,spp_programs.model_spp_program_membership,spp_registry.group_registry_write,1,1,1,0 access_spp_program_membership_registrar,Program Membership Registrar Access,spp_programs.model_spp_program_membership,spp_registry.group_registry_officer,1,1,1,0 access_spp_cycle_membership_registrar,Cycle Membership Registrar Access,spp_programs.model_spp_cycle_membership,spp_registry.group_registry_officer,1,1,1,0 +access_spp_cycle_registry_viewer,Cycle Registry Viewer Read,spp_programs.model_spp_cycle,spp_registry.group_registry_viewer,1,0,0,0 +access_spp_cycle_membership_registry_viewer,Cycle Membership Registry Viewer Read,spp_programs.model_spp_cycle_membership,spp_registry.group_registry_viewer,1,0,0,0 access_spp_entitlement_registry_read,Entitlement Registry Read Access,spp_programs.model_spp_entitlement,spp_registry.group_registry_read,1,0,0,0 access_spp_entitlement_registry_write,Entitlement Registry Write Access,spp_programs.model_spp_entitlement,spp_registry.group_registry_write,1,1,1,0 access_spp_entitlement_registrar,Entitlement Registrar Access,spp_programs.model_spp_entitlement,spp_registry.group_registry_officer,1,0,0,0 diff --git a/spp_programs/static/description/index.html b/spp_programs/static/description/index.html index 6ca70d87..50e35cbb 100644 --- a/spp_programs/static/description/index.html +++ b/spp_programs/static/description/index.html @@ -658,6 +658,25 @@

    Changelog

+

19.0.2.1.3

+
    +
  • fix(security): align Program Viewer / Validator / Cycle Approver roles +with the OP#951 menu audit — Program Viewer additionally gets +group_registry_viewer + group_approval_viewer (read-only +Registry + Approvals access); all three program roles get +group_hazard_viewer + group_gis_report_user so they retain +Hazard / GIS Reports visibility once those menu roots are gated. Adds +spp_hazard and spp_gis_report to module dependencies.
    • +
  • fix(security): hide the Registry top-level menu for Global Program +Cycle Approver per the OP#951 audit. Swap Tier-2 +spp_registry.group_registry_viewer (which gates the Registry menu) +for Tier-3 spp_registry.group_registry_write (ACL-only, no menu). +group_registry_write transitively implies group_registry_read, +so the role keeps read+write access to registrant data via Programs +cross-references — only the dedicated top-level menu disappears.
    • +
+
+

19.0.2.1.2

  • fix(security): add global ir.rule records on @@ -671,7 +690,7 @@

    19.0.2.1.2

    no-op for users with no center areas (global roles).
-
+

19.0.2.1.1

  • fix(views): apply spp_registry.x2many_no_padding widget to the @@ -680,7 +699,7 @@

    19.0.2.1.1

    19 inserts on inline list-in-form views (#943).
-
+

19.0.2.0.11

  • Fix TypeError: 'NoneType' object is not iterable when clicking @@ -691,7 +710,7 @@

    19.0.2.0.11

    omit the state filter instead of crashing on tuple(None)
-
+

19.0.2.0.10

  • Increase parallel-safe channel limits (cycle, eligibility_manager, @@ -704,7 +723,7 @@

    19.0.2.0.10

    submission on double-click
-
+

19.0.2.0.9

  • Add context flags (skip_registrant_statistics, @@ -717,7 +736,7 @@

    19.0.2.0.9

    _compute_has_members
-
+

19.0.2.0.8

  • Replace OFFSET pagination with NTILE-based ID-range batching in all @@ -728,7 +747,7 @@

    19.0.2.0.8

    program and cycle
-
+

19.0.2.0.7

  • Bulk membership creation using raw SQL INSERT ON CONFLICT DO NOTHING @@ -737,7 +756,7 @@

    19.0.2.0.7

    _add_beneficiaries with bulk SQL path
-
+

19.0.2.0.6

  • Remove unused entitlement_base_model.py (dead code, never imported)
    • @@ -746,34 +765,34 @@

    19.0.2.0.6

    payment, and fund tests (172 → 492 tests)
-
+

19.0.2.0.5

  • Batch create entitlements and payments instead of one-by-one ORM creates
-
+

19.0.2.0.4

  • Fetch fund balance once per approval batch instead of per entitlement
-
+

19.0.2.0.3

  • Replace cycle computed fields (total_amount, entitlements_count, approval flags) with SQL aggregation queries
-
+

19.0.2.0.2

  • Add composite indexes for frequent query patterns on entitlements and program memberships
-
+

19.0.2.0.1

  • Replace Python-level uniqueness checks with SQL UNIQUE constraints for @@ -782,7 +801,7 @@

    19.0.2.0.1

    constraint creation
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_programs/static/src/js/form_controller_create.js b/spp_programs/static/src/js/form_controller_create.js index f0bc222c..2ebb31eb 100644 --- a/spp_programs/static/src/js/form_controller_create.js +++ b/spp_programs/static/src/js/form_controller_create.js @@ -5,19 +5,24 @@ import {patch} from "@web/core/utils/patch"; import {onMounted, onPatched, onWillUnmount} from "@odoo/owl"; /** - * Patch FormController to respect context.create = false and disable create - * for specific models (entitlements). + * Patch FormController to hide the form "New" button when the user lacks + * create permission, or for models where create is contextually forbidden. * - * In Odoo 19, the "New" button may still appear in various scenarios: - * - When navigating from list to form view with context.create = false - * - When expanding a dialog (creates a new action without preserving context) + * In Odoo 19, `t-if="canCreate"` on the form template does not always prevent + * the "New" button from rendering — notably the breadcrumb-area button can + * leak through when the form arch was first loaded as a privileged user and + * cached, or in some action navigation flows. This patch enforces hiding via + * DOM manipulation for: * - * This patch hides the New button via DOM manipulation for: - * 1. Any view with context.create === false - * 2. Entitlement models (should only be created from cycles) + * 1. Any view with `context.create === false`. + * 2. Models in MODELS_WITHOUT_CREATE (always-hide; never should be created + * directly from the form, e.g. entitlements). + * 3. `this.canCreate === false` — i.e. the ACL-derived archInfo.activeActions + * .create is false. This is the ACL-aware path that preserves the button + * for users who DO have create permission. */ -// Models that should never show the create button +// Models that should never show the create button regardless of ACL const MODELS_WITHOUT_CREATE = [ "spp.entitlement", "spp.entitlement.inkind", @@ -33,7 +38,8 @@ patch(FormController.prototype, { const modelName = this.props.resModel; const shouldHideCreate = this.props.context?.create === false || - MODELS_WITHOUT_CREATE.includes(modelName); + MODELS_WITHOUT_CREATE.includes(modelName) || + this.canCreate === false; if (shouldHideCreate) { this._hideCreateObserver = null; diff --git a/spp_programs/views/cycle_compliance_view.xml b/spp_programs/views/cycle_compliance_view.xml index 847fd2d2..cfd55912 100644 --- a/spp_programs/views/cycle_compliance_view.xml +++ b/spp_programs/views/cycle_compliance_view.xml @@ -18,6 +18,7 @@ class="btn-warning" confirm="Filtering is a one-way action. Are you sure you want to apply compliance criteria?" invisible="not allow_filter_compliance_criteria or compliance_criteria_applied" + groups="spp_programs.group_programs_manager" /> diff --git a/spp_programs/views/cycle_view.xml b/spp_programs/views/cycle_view.xml index c4a7cae4..f21d98cb 100644 --- a/spp_programs/views/cycle_view.xml +++ b/spp_programs/views/cycle_view.xml @@ -134,7 +134,7 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details. string="Copy Beneficiaries" icon="fa-copy" invisible="state != 'draft'" - groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator" + groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer" /> - +
+

19.0.2.0.2

+
    +
  • fix(security): grant group_service_points_viewer to +spp_user_roles’ Global Registrar and Local Registrar roles so they can +browse service points per the OP#951 menu audit.
    • +
+
+

19.0.2.0.1

  • fix(views): apply spp_registry.x2many_no_padding widget to the @@ -524,7 +532,7 @@

    19.0.2.0.1

    placeholder rows Odoo 19 inserts on inline list-in-form views (#943).
-
+

19.0.2.0.0

  • Initial migration to OpenSPP2
    • diff --git a/spp_service_points/views/service_points_view.xml b/spp_service_points/views/service_points_view.xml index ca574200..a9399f30 100644 --- a/spp_service_points/views/service_points_view.xml +++ b/spp_service_points/views/service_points_view.xml @@ -51,6 +51,7 @@ string="Enable Service Point" class="btn-success" invisible="not is_disabled or not id" + groups="spp_service_points.group_service_points_officer,spp_service_points.group_service_points_manager" confirm="Enable this service point? It will become active again." />
+

19.0.2.0.1

+
    +
  • fix(security): drop the Program Manager → group_studio_viewer +extension per the OP#951 menu audit (Program Manager should NOT see +the Studio top-level menu). Removes data/user_roles.xml from the +module entirely; System Admin retains Studio visibility via +spp_security.group_spp_admin → group_studio_manager (wired in +spp_studio/security/groups.xml).
    • +
+
+

19.0.2.0.0

  • Initial migration to OpenSPP2