[IMP]hide_portal_module_by_user: fix invoices access in v18

hide_portal_module_by_user/__manifest__.py

@@ -5,7 +5,7 @@
     'name': 'Hide Portal Module By User',
     'description': """
         Show / Hide Specific Portal Docs on res.users""",
-    'version': '16.0.1.0.0',
+    'version': "18.0.1.1.0",
     'license': 'AGPL-3',
     'author': 'Munin',
     'website': 'https://github.com/AxeldelosReyes/odoo_web_modules',

hide_portal_module_by_user/controllers/main.py

@@ -5,14 +5,33 @@ from odoo.http import request
 from odoo.addons.portal.controllers.portal import CustomerPortal
 from werkzeug.exceptions import NotFound
 
-WHITELISTED_ROUTES = ['/my/home', '/my', '/my/account', '/my/security', '/my/payment_method']
+from ..models.res_users import match_portal_url
+
+# Routes always reachable, whatever the portal groups of the user.
+#
+# Split in two because of how each route is matched, not because of how
+# important it is: both lists are equally "always reachable".
+#
+# Exact match, for routes that have no sub-route of their own. '/my' has to
+# stay here in any case: as a prefix it would match every portal page and
+# make this module a no-op.
+WHITELISTED_ROUTES = ['/my', '/my/home', '/my/account', '/my/security', '/my/payment_method']
+
+# Prefix match, for routes that also serve detail and pager sub-pages
+# ('/my/invoices/<id>', '/my/invoices/page/<n>', '/my/invoices/overdue'),
+# which go through _prepare_portal_layout_values too.
+WHITELISTED_ROUTE_PREFIXES = ['/my/invoices']
 
 
 class CustomerPortalPolicy(CustomerPortal):
     def _prepare_portal_layout_values(self):
         vals = super()._prepare_portal_layout_values()
         current_path = request.httprequest.path
-        if request.env.user.validate_portal_url(current_path) or current_path in WHITELISTED_ROUTES:
+        if current_path in WHITELISTED_ROUTES:
+            return vals
+        if any(match_portal_url(route, current_path) for route in WHITELISTED_ROUTE_PREFIXES):
+            return vals
+        if request.env.user.validate_portal_url(current_path):
             return vals
         if '/my/' not in current_path:
             return vals

hide_portal_module_by_user/hooks.py

@@ -1,7 +1,7 @@
 from odoo import api, SUPERUSER_ID
 
 
-def post_init_hook(cr, registry):
+def post_init_hook(env):
     """Loaded after installing the module.
     This module's DB modifications will be available.
     :param odoo.sql_db.Cursor cr:
@@ -9,7 +9,6 @@ def post_init_hook(cr, registry):
     :param odoo.modules.registry.RegistryManager registry:
         Database registry, using v7 api.
     """
-    env = api.Environment(cr, SUPERUSER_ID, {})
     portal_views = env['ir.ui.view'].search([('inherit_id.xml_id', '=', 'portal.portal_my_home')])
     if portal_views:
         for p in portal_views:

hide_portal_module_by_user/models/ir_ui_view.py

@@ -32,20 +32,25 @@ class IrUiView(models.Model):
 
         view_xml = etree.fromstring(self.arch)
         groups_from_view = {}
-        for option in view_xml.xpath("//t[@t-call='portal.portal_docs_entry']"):
+        xpath_expressions = [
-            has_title = option.find("t[@t-set='title']")
+            "//t[@t-call='portal.portal_docs_entry']",
-            if has_title is not None:
+            "//t[@t-call='helpdesk_mgmt.portal_docs_entry']",
-                title = has_title.text
+        ]
-            else:
+        for xpath_expr in xpath_expressions:
-                title = self.name
+            for option in view_xml.xpath(xpath_expr):   
+                has_title = option.find("t[@t-set='title']")
+                if has_title is not None:
+                    title = has_title.text
+                else:
+                    title = self.name
 
-            k = _generate_name(title)
+                k = _generate_name(title)
-            target_url = option.find("t[@t-set='url']")
+                target_url = option.find("t[@t-set='url']")
-            if target_url is not None:
+                if target_url is not None:
-                target_url = target_url.get('t-value').replace("'", '')
+                    target_url = target_url.get('t-value').replace("'", '')
-            else:
+                else:
-                raise ValueError(_("No target url found"))
+                    raise ValueError(_("No target url found"))
-            groups_from_view[k] = target_url
+                groups_from_view[k] = target_url
 
         search_groups = self.env['res.groups'].sudo().search([('portal_url', 'in', list(groups_from_view.values()))])
         category_portal_type = self.env.ref('base_portal_type.category_portal_type')

hide_portal_module_by_user/models/res_users.py

@@ -1,16 +1,47 @@
 # Copyright 2026 Munin
 # License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
 
+from urllib.parse import parse_qsl, urlsplit
+
 from odoo import fields, models
 
 
+def match_portal_url(portal_url, target):
+    """Whether ``target`` is covered by the ``portal_url`` of a portal group.
+
+    A group url is the one read from the portal.portal_docs_entry t-call it
+    was generated from, and it covers:
+
+    - the listing itself and its sub-pages, since the portal serves detail
+      and pager pages below it ('/my/projects/135', '/my/projects/page/2'),
+      which go through _prepare_portal_layout_values as well;
+    - the entries narrowing that listing down with query arguments. Odoo 18
+      splits some listings in several entries this way, eg. account has
+      '/my/invoices?filterby=invoices' and '/my/invoices?filterby=bills'
+      where 16.0 had a single '/my/invoices'.
+
+    A group url carrying query arguments only matches targets carrying them
+    all, so a group can be restricted to one such entry; a group url without
+    any matches every entry of the listing.
+    """
+    if not portal_url or not target:
+        return False
+    ref = urlsplit(portal_url)
+    got = urlsplit(target)
+    root = ref.path.rstrip('/')
+    if not (got.path == root or got.path.startswith(root + '/')):
+        return False
+    return set(parse_qsl(ref.query)) <= set(parse_qsl(got.query))
+
+
 class ResUsers(models.Model):
     _inherit = "res.users"
 
     portal_url = fields.Char(string='Portal URL')
 
     def validate_portal_url(self, url):
-        group = self.sudo().env['res.groups'].search([('portal_url', '=', url)])
+        groups = self.sudo().env['res.groups'].search([('portal_url', '!=', False)])
-        if self.env.user in group.users:
+        for group in groups.filtered(lambda g: match_portal_url(g.portal_url, url)):
-            return True
+            if self.env.user in group.users:
+                return True
         return False

hide_portal_module_by_user/views/portal_home.xml

@@ -1,24 +1,18 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <odoo>
     <data>
-        <template inherit_id="portal.portal_docs_entry" id="hide_portal_user">
+      <template inherit_id="portal.portal_docs_entry" id="hide_portal_user">
-            <xpath expr="//a" position="replace">
+        <!-- Since 18.0 the entry link is wrapped in a "o_portal_index_card"
-                <t t-if="request.env.user.validate_portal_url(url)">
+             div, which the portal javascript un-hides once the counters are
-                    <a t-att-href="url" t-att-title="title"
+             loaded. The t-if has to be carried by that card, otherwise
-                        class="list-group-item list-group-item-action d-flex align-items-center justify-content-between d-none">
+             hiding the link only leaves an empty card in the grid.
-                        <t t-esc="title" />
+             The card class is dynamic (t-att-class), so hasclass() cannot
-                        <t t-if='count'>
+             be used to locate it. -->
-                            <span class="badge text-bg-secondary rounded-pill" t-esc="count" />
+        <xpath expr="//a/.." position="attributes">
-                        </t>
+          <!-- config_card entries (Connection &amp; Security) are not
-                        <t t-elif="placeholder_count">
+               document listings and are never group restricted. -->
-                            <span class="badge text-bg-secondary rounded-pill"
+          <attribute name="t-if">config_card or request.env.user.validate_portal_url(url)</attribute>
-                                t-att-data-placeholder_count="placeholder_count">
+        </xpath>
-                                <i class="fa fa-spin fa-circle-o-notch"></i>
+      </template>
-                            </span>
-                        </t>
-                    </a>
-                </t>
-            </xpath>
-        </template>
     </data>
-</odoo>
+</odoo>

hide_portal_module_by_user/views/res_groups.xml

@@ -10,7 +10,7 @@
         <field name="arch" type="xml">
             <field name="share" position="after">
                 <field name="portal_url" readonly="1"
-                       attrs="{'invisible':[('portal_url','=',False)]}"/>
+                       invisible="portal_url == False"/>
             </field>
         </field>
     </record>

mail_message_copy_in_partner/README.rst

@@ -1,52 +0,0 @@
-====================
-mail_message_copy_in_partner
-====================
-
-Installation
-============
-Use Odoo normal module installation procedure to install ``mail_message_copy_in_partner``.
-
-
-Configuration
-=============
-
-Nothing to do
-
-
-Usage
-=====
-If module is installed, notes will never send email to partners not linked to internal users.
-
-
-Known issues / Roadmap
-======================
-
-None yet.
-
-Bug Tracker
-===========
-
-Bugs are tracked on `our issues website <https://github.com/elabore-coop/ux-tools/issues>`_. In case of
-trouble, please check there if your issue has already been
-reported. If you spotted it first, help us smashing it by providing a
-detailed and welcomed feedback.
-
-Credits
-=======
-
-Contributors
-------------
-
-* Clément Thomas
-
-Funders
--------
-
-The development of this module has been financially supported by:
-* Elabore (https://elabore.coop)
-
-
-Maintainer
-----------
-
-This module is maintained by Elabore.

mail_message_copy_in_partner/__init__.py

@@ -1,4 +0,0 @@
-# -*- coding: utf-8 -*-
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from . import models

mail_message_copy_in_partner/__manifest__.py

@@ -1,89 +0,0 @@
-# Copyright 2022 Laetitia Élabore (Elabore)
-# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
-
-{
-    "name": "mail_message_copy_in_partner",
-    "version": "16.0.1.0.0",
-    "author": "Elabore",
-    "website": "https://github.com/elabore-coop/ux-tools",
-    "maintainer": "Clément",
-    "license": "AGPL-3",
-    "category": "Tools",
-    "summary": "If current model has partner_id field, all messages will be copied in partner's chatter",
-    "description": """
-   :image: https://img.shields.io/badge/licence-AGPL--3-blue.svg
-   :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
-   :alt: License: AGPL-3
-=================
-mail_message_copy_in_partner
-=================
-If current model has partner_id field, all messages will be copied in partner's chatter
-New message is a note without recipients
-
-
-Installation
-============
-
-Install ``mail_message_copy_in_partner``, all dependencies will be installed by default.
-
-Known issues / Roadmap
-======================
-
-None yet.
-
-Bug Tracker
-===========
-
-Bugs are tracked on `our issues website
-<https://github.com/elabore-coop/ux-tools/issues>`_. In case of
-trouble, please check there if your issue has already been
-reported. If you spotted it first, help us smashing it by providing a
-detailed and welcomed feedback.
-
-Credits
-=======
-
-Images
-------
-
-* Elabore: `Icon <https://elabore.coop/web/image/res.company/1/logo?unique=f3db262>`_.
-
-Contributors
-------------
-
-* Clément Thomas
-
-Funders
--------
-
-The development of this module has been financially supported by:
-* Elabore (https://elabore.coop)
-
-
-Maintainer
-----------
-This module is maintained by Elabore.
-
-""",
-    # any module necessary for this one to work correctly
-    'depends' : ['base_setup'],
-    "qweb": [
-        # "static/src/xml/*.xml",
-    ],
-    "external_dependencies": {
-        "python": [],
-    },
-    # always loaded
-    "data": [        
-        
-    ],
-    # only loaded in demonstration mode
-    "demo": [],
-    "js": [],
-    "css": [],
-    "installable": True,
-    # Install this module automatically if all dependency have been previously
-    # and independently installed.  Used for synergetic or glue modules.
-    "auto_install": False,
-    "application": False,
-}

mail_message_copy_in_partner/models/__init__.py

@@ -1 +0,0 @@
-from . import mail_thread

mail_message_copy_in_partner/models/mail_thread.py

@@ -1,24 +0,0 @@
-from odoo import api, models, _
-
-
-class MailThread(models.AbstractModel):
-    _inherit = 'mail.thread'
-
-    @api.returns('mail.message', lambda value: value.id)
-    def message_post(self, body='', **kwargs):
-        #send message to related partner        
-        if hasattr(self, 'partner_id') and self.partner_id:
-            msg = _('<b>[%(object)s]</b> %(body)s',object=self._get_html_link(), body=body)       
-
-            new_kwargs = kwargs.copy()
-
-            #new message is a note
-            new_kwargs['subtype_xmlid'] = "mail.mt_note"
-
-            #do not send anything
-            new_kwargs['partner_ids'] = []            
-
-            self.partner_id.message_post(body=msg, **new_kwargs)
-
-        return super(MailThread, self).message_post(body=body, **kwargs)
-    

mail_prevent_send_note_to_external/README.rst

@@ -1,52 +0,0 @@
-====================
-mail_prevent_send_note_to_external
-====================
-
-Installation
-============
-Use Odoo normal module installation procedure to install ``mail_prevent_send_note_to_external``.
-
-
-Configuration
-=============
-
-Nothing to do
-
-
-Usage
-=====
-If module is installed, notes will never send email to partners not linked to internal users.
-
-
-Known issues / Roadmap
-======================
-
-None yet.
-
-Bug Tracker
-===========
-
-Bugs are tracked on `our issues website <https://github.com/elabore-coop/ux-tools/issues>`_. In case of
-trouble, please check there if your issue has already been
-reported. If you spotted it first, help us smashing it by providing a
-detailed and welcomed feedback.
-
-Credits
-=======
-
-Contributors
-------------
-
-* Clément Thomas
-
-Funders
--------
-
-The development of this module has been financially supported by:
-* Elabore (https://elabore.coop)
-
-
-Maintainer
-----------
-
-This module is maintained by Elabore.

mail_prevent_send_note_to_external/__init__.py

@@ -1,4 +0,0 @@
-# -*- coding: utf-8 -*-
-# Part of Odoo. See LICENSE file for full copyright and licensing details.
-
-from . import models

mail_prevent_send_note_to_external/__manifest__.py

@@ -1,88 +0,0 @@
-# Copyright 2022 Laetitia Élabore (Elabore)
-# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
-
-{
-    "name": "mail_prevent_send_note_to_external",
-    "version": "16.0.1.0.0",
-    "author": "Elabore",
-    "website": "https://github.com/elabore-coop/ux-tools",
-    "maintainer": "Clément",
-    "license": "AGPL-3",
-    "category": "Tools",
-    "summary": "Prevent chatter note to send email to external partner",
-    "description": """
-   :image: https://img.shields.io/badge/licence-AGPL--3-blue.svg
-   :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
-   :alt: License: AGPL-3
-=================
-mail_prevent_send_note_to_external
-=================
-
-Prevent chatter note to send email to external partner
-
-Installation
-============
-
-Install ``mail_prevent_send_note_to_external``, all dependencies will be installed by default.
-
-Known issues / Roadmap
-======================
-
-None yet.
-
-Bug Tracker
-===========
-
-Bugs are tracked on `our issues website
-<https://github.com/elabore-coop/ux-tools/issues>`_. In case of
-trouble, please check there if your issue has already been
-reported. If you spotted it first, help us smashing it by providing a
-detailed and welcomed feedback.
-
-Credits
-=======
-
-Images
-------
-
-* Elabore: `Icon <https://elabore.coop/web/image/res.company/1/logo?unique=f3db262>`_.
-
-Contributors
-------------
-
-* Clément Thomas
-
-Funders
--------
-
-The development of this module has been financially supported by:
-* Elabore (https://elabore.coop)
-
-
-Maintainer
-----------
-This module is maintained by Elabore.
-
-""",
-    # any module necessary for this one to work correctly
-    'depends' : ['base_setup'],
-    "qweb": [
-        # "static/src/xml/*.xml",
-    ],
-    "external_dependencies": {
-        "python": [],
-    },
-    # always loaded
-    "data": [        
-        
-    ],
-    # only loaded in demonstration mode
-    "demo": [],
-    "js": [],
-    "css": [],
-    "installable": True,
-    # Install this module automatically if all dependency have been previously
-    # and independently installed.  Used for synergetic or glue modules.
-    "auto_install": False,
-    "application": False,
-}

mail_prevent_send_note_to_external/models/__init__.py

@@ -1 +0,0 @@
-from . import mail_thread

mail_prevent_send_note_to_external/models/mail_thread.py

@@ -1,19 +0,0 @@
-from odoo import api, models, _
-
-
-class MailThread(models.AbstractModel):
-    _inherit = 'mail.thread'
-
-    @api.returns('mail.message', lambda value: value.id)
-    def message_post(self, **kwargs):    
-        #check subtype_xmlid and partner_ids, and remove external partners if subtype is "note"
-        if kwargs.get("subtype_xmlid") == 'mail.mt_note' and "partner_ids" in kwargs:
-            new_partner_ids = []
-            for partner_id in kwargs["partner_ids"]:
-                user = self.env["res.users"].search([('partner_id','=',partner_id)])
-                if user.active and user.has_group('base.group_user'):
-                    new_partner_ids.append(partner_id)
-            kwargs["partner_ids"] = new_partner_ids
-
-        message = super(MailThread, self).message_post(**kwargs)
-        return message