From 5b6a217b839d09a22e1f68b993c857ef27bd4de1 Mon Sep 17 00:00:00 2001
From: Suherdy Yacob <suherdy.yacob@mapan.co.id>
Date: Tue, 10 Mar 2026 09:59:49 +0700
Subject: [PATCH] feat: Add a new `ir.rule` to restrict access to MRP Routing
 Workcenters based on user permissions.

---
 security/ir_rule.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/security/ir_rule.xml b/security/ir_rule.xml
index a724d35..59f003e 100644
--- a/security/ir_rule.xml
+++ b/security/ir_rule.xml
@@ -99,6 +99,19 @@
                 )
             </field>
         </record>
+
+        <!-- MRP Routing Workcenter (Operations) -->
+        <record id="mrp_routing_workcenter_allowed_rule" model="ir.rule">
+            <field name="name">MRP Routing Workcenter Allowed Access</field>
+            <field name="model_id" ref="mrp.model_mrp_routing_workcenter"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">
+                (
+                [(1, '=', 1)] if user.env.context.get('bypass_user_restriction') or user.has_group('base.group_system') else
+                [('workcenter_id', 'in', user.sql_allowed_workcenter_ids())] if user.sql_allowed_workcenter_ids() else [(1, '=', 1)]
+                )
+            </field>
+        </record>
         
         <!-- Approval Category -->
         <record id="approval_category_allowed_rule" model="ir.rule">