[18.0][ADD] operating_unit_window_action_isolation

operating_unit_window_action_isolation/README.rst

@@ -0,0 +1,130 @@
+======================================
+Operating Unit Window Action Isolation
+======================================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:30504a1a9af9d8b728d4f79e1ec6971b08bc717e426e975d265cb4f2b8963db9
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
+    :alt: License: AGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Foperating--unit-lightgray.png?logo=github
+    :target: https://github.com/OCA/operating-unit/tree/18.0/operating_unit_window_action_isolation
+    :alt: OCA/operating-unit
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/operating-unit-18-0/operating-unit-18-0-operating_unit_window_action_isolation
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/operating-unit&target_branch=18.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module extends Odoo window actions to automatically restrict
+records according to the user's default operating unit.
+
+When a user opens a menu linked to an ``ir.actions.act_window``, an
+additional domain is injected when:
+
+- The user is not the superuser.
+- The user has a default operating unit configured.
+- The target model contains an ``operating_unit_id`` field.
+
+The injected domain allows access to:
+
+- Records belonging to the user's default operating unit.
+- Records without an operating unit assigned.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Usage
+=====
+
+Configure operating units and assign a default operating unit to users.
+
+Example:
+
+- User A → Default Operating Unit = OU-A
+- User B → Default Operating Unit = OU-B
+
+When a window action targets a model containing an ``operating_unit_id``
+field, the action domain is automatically extended.
+
+For User A:
+
+.. code:: python
+
+   [('operating_unit_id', 'in', [False, OU_A_ID])]
+
+For User B:
+
+.. code:: python
+
+   [('operating_unit_id', 'in', [False, OU_B_ID])]
+
+As a result:
+
+- User A sees records belonging to OU-A and records without an operating
+  unit.
+- User B sees records belonging to OU-B and records without an operating
+  unit.
+- Users without a default operating unit are not affected.
+- The superuser is not affected.
+
+Known issues / Roadmap
+======================
+
+- No known issues.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/operating-unit/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/operating-unit/issues/new?body=module:%20operating_unit_window_action_isolation%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* CIT Services
+
+Contributors
+------------
+
+- `CIT Services <https://cit-services.eu/>`__
+
+  - Manfred Nelvin <m.nelvin@cit-services.eu>
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+This module is part of the `OCA/operating-unit <https://github.com/OCA/operating-unit/tree/18.0/operating_unit_window_action_isolation>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

operating_unit_window_action_isolation/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (C) 2016-2027 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from . import models

operating_unit_window_action_isolation/__manifest__.py

@@ -0,0 +1,20 @@
+# Copyright (C) 2016-2027 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+{
+    "name": "Operating Unit Window Action Isolation",
+    "summary": "Restrict window action records by operating unit",
+    "version": "18.0.1.0.0",
+    "category": "Generic Modules",
+    "author": "CIT Services, Odoo Community Association (OCA)",
+    "company": "CIT Services",
+    "website": "https://github.com/OCA/operating-unit",
+    "license": "AGPL-3",
+    "depends": [
+        "operating_unit",
+        "sale_operating_unit",
+    ],
+    "data": [],
+    "installable": True,
+    "application": False,
+}

operating_unit_window_action_isolation/models/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (C) 2016-2027 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from . import ir_actions_act_window

operating_unit_window_action_isolation/models/ir_actions_act_window.py

@@ -0,0 +1,44 @@
+# Copyright (C) 2016-2027 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from odoo import models
+from odoo.osv import expression
+from odoo.tools.safe_eval import safe_eval
+
+
+class IrActionsActWindow(models.Model):
+    _inherit = "ir.actions.act_window"
+
+    def read(self, fields=None, load="_classic_read"):
+        """Restrict actions to the user's default operating unit."""
+        result = super().read(fields=fields, load=load)
+
+        if self.env.is_superuser():
+            return result
+
+        user_ou = self.env.user.default_operating_unit_id
+        if not user_ou:
+            return result
+
+        for action in result:
+            res_model = action.get("res_model")
+
+            if (
+                not res_model
+                or res_model not in self.env
+                or "operating_unit_id" not in self.env[res_model]._fields
+            ):
+                continue
+
+            ou_domain = [("operating_unit_id", "in", [False, user_ou.id])]
+
+            domain = []
+            if action.get("domain"):
+                try:
+                    domain = safe_eval(action["domain"])
+                except (ValueError, SyntaxError, TypeError):
+                    continue
+
+            action["domain"] = expression.AND([domain, ou_domain])
+
+        return result

operating_unit_window_action_isolation/pyproject.toml

@@ -0,0 +1,3 @@
+[build-system]
+requires = ["whool"]
+build-backend = "whool.buildapi"

operating_unit_window_action_isolation/readme/CONTRIBUTORS.md

@@ -0,0 +1,2 @@
+- [CIT Services](https://cit-services.eu/)
+  - Manfred Nelvin \<m.nelvin@cit-services.eu\>

operating_unit_window_action_isolation/readme/DESCRIPTION.md

@@ -0,0 +1,14 @@
+This module extends Odoo window actions to automatically restrict
+records according to the user's default operating unit.
+
+When a user opens a menu linked to an `ir.actions.act_window`, an
+additional domain is injected when:
+
+- The user is not the superuser.
+- The user has a default operating unit configured.
+- The target model contains an `operating_unit_id` field.
+
+The injected domain allows access to:
+
+- Records belonging to the user's default operating unit.
+- Records without an operating unit assigned.

operating_unit_window_action_isolation/readme/ROADMAP.md

@@ -0,0 +1 @@
+- No known issues.

operating_unit_window_action_isolation/readme/USAGE.md

@@ -0,0 +1,27 @@
+Configure operating units and assign a default operating unit to users.
+
+Example:
+
+- User A → Default Operating Unit = OU-A
+- User B → Default Operating Unit = OU-B
+
+When a window action targets a model containing an `operating_unit_id` field, the action domain is automatically extended.
+
+For User A:
+
+```python
+[('operating_unit_id', 'in', [False, OU_A_ID])]
+```
+
+For User B:
+
+```python
+[('operating_unit_id', 'in', [False, OU_B_ID])]
+```
+
+As a result:
+
+- User A sees records belonging to OU-A and records without an operating unit.
+- User B sees records belonging to OU-B and records without an operating unit.
+- Users without a default operating unit are not affected.
+- The superuser is not affected.