From 94705c64bfea3242bee2c2cddf5df9c1524f3088 Mon Sep 17 00:00:00 2001
From: Suherdy Yacob <suherdy.yacob@mapan.co.id>
Date: Tue, 6 Jan 2026 11:02:09 +0700
Subject: [PATCH] feat: Introduce permissive `ir.rule`s and SQL-based ID
 retrieval for access restrictions, improving stock location visibility and
 adding `stock_account` dependency.

---
 __manifest__.py                               |   4 +-
 .../restricted_models.cpython-312.pyc         | Bin 4224 -> 5895 bytes
 models/restricted_models.py                   |  36 ++++++-
 security/ir.model.access.csv                  |   2 +
 security/ir_rule.xml                          |  97 ++++++++++++++++++
 5 files changed, 133 insertions(+), 6 deletions(-)
 create mode 100644 security/ir.model.access.csv
 create mode 100644 security/ir_rule.xml

diff --git a/__manifest__.py b/__manifest__.py
index 00ce14b..53f1499 100644
--- a/__manifest__.py
+++ b/__manifest__.py
@@ -16,8 +16,10 @@
     """,
     'category': 'Extra Tools',
     'author': 'Suherdy Yacob',
-    'depends': ['base', 'stock', 'mrp', 'approvals'],
+    'depends': ['base', 'stock', 'mrp', 'approvals', 'stock_account'],
     'data': [
+        'security/ir.model.access.csv',
+        'security/ir_rule.xml',
         'views/res_users_views.xml',
     ],
     'installable': True,
diff --git a/models/__pycache__/restricted_models.cpython-312.pyc b/models/__pycache__/restricted_models.cpython-312.pyc
index a6c7e60485a90a9423477b0217bdb4984be818c1..056312a307a85144bee24e69a4e942768f538009 100644
GIT binary patch
literal 5895
zcmeHLO>7&-6`o!0@=rgMVo`M@yJBNG5fepBQKd1QxUFJIabuZsBR7T##f$ask|Mq0
z(z8oRq$$`2T$t_;EFB6t2#Pqp#DZE>N1uxJR-iz!tb)>*x~PGkdUGokO?~Q{S*}E>
zQdJvOP9A`7X5PH{d+&Yk&GNTRO+f_Zm*w$vM>9fyp&hq~wZ>{UhtL92k;>^PL2F*;
zCiw(E=}CAv+V|+fq?iyn#3K!58r=mpYR$I<YtWMLtHO1Z2=M3~q>9&(>ecv6n=@8V
zmpo1{(ZD2qAnD&lvXMy!Kr*<CWD}EY0LjK(B%7IJ6G%4iA{i=h(a>M%q2p1Wcqa{2
z(@o-$bLl8Yg4#?DYo?htvWif5O{!vg(beAp0Tpv4E>lxfofIfs^(^rY=Od&FB_62w
z6LD53p-hcmFQ0KuSH~;~B~OxbSK-hOGktYaYR#ouJ&10J3ZFs>{{cwNiX~C?J`ZE_
z{0{>HaA(Capd4#Wqo^-l^o<RT3>`lcA%c`vO@fL6s3XJgjh>1W_eIX07<z9gk~cL>
zxyK@hO-%0+6^IXOIbBvX!Yi2gv>8pwTN?2vHA|V0bv^1O9xXdXg2}X|t5Q~;)JV{h
zFX)=n_SM!T;-$QX3xva_7Z#4N@>q#Y7?WDe%ui@oEyPY2tO>9Rm@8(ehVj)SF(q$W
z#-yyOM%IkUiUM|%z<3r;D;5|~x=@hl1~JFPF?UE)C5O|OE09o1vm`jGF%4|EJEks9
zb!(0Txr!b(hvzcY_MS?6&)xRr=T_SL?eOc%=k68n>Gr!H*p26}4&4`gH-@hb--us}
z&%J*8joUAOCLF%saq#08KYa1y*oU!|j#vKB&^z~?@<3Vs!Qk&3dTpWiUr@2D{(4{I
zzzc!`Tdfz@?N;9g)(vnr4J9}gC3uxfcr+oy;=sBzYp9+wN^&ZHJ>a@P!dpf&T*5a-
zt<*eb8Op`8GS(&xP)IQZYEv%uO}h-G-V3P#n5VxB{{3Taf%@O(-B@osZ#IiN$hudm
zTPL%P|EioDe9Z4!0atkYH7U}zAIWUD+crvDs>#iYR+GC|214uBQsQPf6VQ?ZJgb1E
zq$kCtc=x2UoYmsaxalpSA00-h#FhAxrzHH$>+S(&@WmguUXV?#FNKYKPBIIorA?Bi
zbt5p~9Rwd`K5I(MM$*PG)^x(BRrqBWJ;ZAylcr`7QBO~%p)#<l;l&`PHzB;4Cj#|+
z5}1%piEYUI8h64lrq(8&f%qU1&3q1|e3GfjSeaP#5y8~-B=M>Mt8^BBnTmH&5}|V%
z>Tp5=lBDP|AWkx=DILsS#rvrAOF)Y4o4u~Dwh7gic^$~-0Itx!TQfIjZe9NV<vabK
z9{J?Rr^h}yRy}mIa_Ff2X8f~5qYpZwce{Vlv)HpdY7eP)GE+@vE6Hp%X;zYEH91vD
zPOWrImrp(jcP*TsKY!=_pN`+f%V+NO|EkmOKV^R{Zg-Eagin`;AB5U&PT#z8d+KiT
z-q3Ht<tr<pQQJSd3g<wJ9v05x@kKxJODr-;5(!E)O5`C_Nu*JdF6CvN#xLmkrF0fT
zQrg1QgNVq23A;0CswqX$bX}4bIot~pCQTIIax~KpO-u<jlo<i?`E_(Z6uElhq3FMH
z?%KIEUJy@ns~+SHIZga32(c-993@(qy-uf<i|K6YOd+QgpL60w&SCXgz<U-dz#6RV
zX{f;aVGq($)4W7A&*DR5Ykb%w0U^Rc_yL%W4^r|KN_v3o0Mh+ijqbv<gU<OLkSBtv
z-9K!f$k=+Ws#_J^s_KP`Ua0D&ie6gjn0<PjIw0tymx)pGb$YrwSRJ8EO1?w~B0w0d
z4($djI%SVx)x<PBVkk0wlN6gBOzE}$COrA!G%WQdpFH)JpCB3j_tdL=k*OC_DkN3a
zOVcXUK34nHfErXAQaq$uan}34rstA(hqUb5l9n6m(sEPW!CIqh5r(q^TXD8NO4Be`
zVlX3t9K4{imSiM}Uzte53l~~q-jq{X(VI1_NIFaW>8z#UtgI8Ch2^XXSz{fTQ9q7?
z$??mSY|gd#72uJO`(%}B37Mr6>LyOQjnwDc@Fqudaoi2U=FfpV5ssJR_TU9uov5mM
zMb)e7rHXo~s#+D*TItA_Pd;ivt!;B-_glkrm+zdkTVA8B;+;3`me~E){kMDWB$l7I
zyP^Bmqk!1eTpnF(MD3Bf4E;^J`}j(DaL2s78{Ut>g)k*FzHQ*Ws}Aoi8)=j_ofYYn
zy~g_~oI7jaiwby#hKtRUIM+A5-rt1xXHRV~M}7IfJ+&Q7H*e^DE2_aNQr+lNWX|v=
zJG*c@3fFm>v^i)G@4@qSHyC{zPKzmdgC08qgr&`T7;XC+rBn78MlA!m95$w8{kUvt
zDFYXZt#Xai2dR{?o`DJMz{(f!7!AAXmt6HTOm%H!%KsF23RvymYIhe|gK$xE4#*QF
zGQ0nzeJX3`tZHtilAEdKW-Gbbe<E~=8{q%uRPYVh`8L0IZ__xO8B;PqZx8{(K=wji
zuG$u4bV{^^_;e$cf-f>6(0{!!eIGjCoqpQyGt4RHgFXO%WQ~BRhVg4410VHtBJ}7V
zT0}fW|K?<$k?ft!k|%>cJK7?0LIwSLf9!wD`SAS)J_lX;$~Lb6dF0_Z?vJSX&*;FP
zP}jp?XZfXSu(J~EynSLNc=)RC?}EU+y4L9DPIGhbFO1KRuOZrAYh#?Lh0=V<<+M?m
a;f0a;ku^lyYrRaS#@RaSA8Z|Vz<&dQSL&w#

literal 4224
zcmeH~O>7%Q6vt<F{h7vb8sZS3A)y3;g=B-`0}=?ae6$?WG*YTowW6+;-Lbv)+Uw5R
zN$k36kRmlfLL~=ej)+sOaNyV@Jr#+|T0R)9il_t^ZU_gd>WO)~-n21oEJw<TtmOaB
zynQn}^XB))vp<JILx^2`ZdtwVN9cE`xR<wE=={wJb)+B#YbcMCIL{?H40TT9^PZ#!
zBMzNK3crCA55ZZxN4FE_zQa5Bq|f&BGEZM0PrvQyXP$vRo&no4$UKMocm{3H6U=kC
zkLOS&6dm~!1|8)rUtU*;W>~ybRHN7$B5OrT3`5lmvNJ75J>5#@Lsq!SB1TXWD=5h+
zILQ;w)8eA=n<#}9ZX>wUZJhLNqBWfKFQKT%8d)moa_*8uNk%Ulq#8D$9$R${vb#jk
z*vEbl=FT5XzQ%P_Ls?epy|P@d1tH^XX|Ja&^wV?I@ESJQlBXF03iphD13isc^=VVi
z4*%CL#iwza+riG0>$o)H`fPb?=*w3Ss^J<}<7=Mp`JHZ<mr%pAU~#I#euXG+`SeuE
zASKJIsd<&%bgB><4O%=YtXP~;rZ7W`7ZyIYJS>*fib$HKuM$Pv3#X_mY>`2{M!Cpb
z{Gvf5DrXu#%VQ8NW%(36FR29zbD$v*7^xK$MOl*!Llg~&-V9vpkK}kp&y%=O&Je0p
z;)|71h7rS1itCE5zx_^JF0=K_ONycwjJPDrj46?URidg~VsMF{RYVwR+`%vIK4L?5
zEU{vRPO$e?C-!p^>kgYGG%}J*9<HMY;pc9xZLQt9_QkdPk?H!C?JM72{BHR+{o%r$
z#E;|mChtz(o4PyI7L=x-w1rGl$e0P$oXeWCxmHBmJaa!hzO}k_<C~S+sXL$i6xqDd
z3ZFLv=R2%-)Zi&VwXo0#SOHNiNO>ZP){qFpENf667R9S&N$Wldh-!hwL@iNROUrA|
z#-524>PAu~nkI@3OkZRk27vJaeTgZBIoSeDjTt5nH_$KPne|T}cmp>te|~wF<GqWx
z!y{kVDbiDJlOxX7QF|2@RXL{?(ibX4QXO;hwdj~)C1(47rz{P!wTK337?xxd1hSHz
z1Q}yuO}a_hjhP5BgS@2U;1dA><mvNFo=7$a4m%kpdzZmY2YBD0>5y&;>9&w-3OO^O
znR9t_w$O^`&rAo0wJ8|j%OJ18E1#hEbufa!-tm~;SNqWmO^%q}kR7&pU6x?)sg5}4
zYTf!Vwg+N6?qci4YcOOZ`(p3%`T{UA;Px#y1-UH%wPqq?&Z*{XwiU@8n%6hk5GV*_
zR%eEZz1vRr;}x15HLvGr@sdt+GAWb@t&ZerF}Au_Kj!s7UME~$A4hCJV)sSgCH6F1
z_CbjyO@XupwJE4(B5Tg&%vr4!$sd~7x7ZLU$TSpUAol-1n2wmpQK49*`ii7|B$Y^7
zr<LkSscVU`UDY-nb9o?_Q!bZo;6yiYgW);ZyA&>=urUovsMZv;woq&eMKf{LoTKKf
z(TbD~O=tp`1bG9-GQ-5)Q&0EXQ=!R1^n~SsuLsJrnsa;(Ks}}#E6x{=_Z)nzI_G5j
zxMA<%c3MCWjcz``Vfs<vJ?Dh}K7E%};hbU+CV%l5<KNJ!U(xig$B!5BR~PHc+snHM
e%DZE>Wu;!*uI;m&sn2iE_p#Wm{;~V9)AC<!_)w<+

diff --git a/models/restricted_models.py b/models/restricted_models.py
index 3307392..34904e3 100644
--- a/models/restricted_models.py
+++ b/models/restricted_models.py
@@ -1,13 +1,23 @@
+import logging
 from odoo import models, api
 from odoo.osv import expression
 
+_logger = logging.getLogger(__name__)
+
+def get_allowed_ids(env, field_name, table_name, user_id):
+    # Use SQL to avoid ORM recursion or self-filtering issues
+    query = f"SELECT {field_name.replace('_ids', '')}_id FROM {table_name} WHERE user_id = %s"
+    env.cr.execute(query, (user_id,))
+    return [r[0] for r in env.cr.fetchall()]
+
 class StockWarehouse(models.Model):
     _inherit = 'stock.warehouse'
 
     @api.model
     def _search(self, domain, offset=0, limit=None, order=None):
         if not self.env.su and not self.env.user.has_group('base.group_system'):
-            domain = expression.AND([domain or [], [('id', 'in', self.env.user.allowed_warehouse_ids.ids)]])
+            allowed_ids = get_allowed_ids(self.env, 'warehouse_ids', 'res_users_stock_warehouse_rel', self.env.user.id)
+            domain = expression.AND([domain or [], [('id', 'in', allowed_ids)]])
         return super()._search(domain, offset=offset, limit=limit, order=order)
 
 class StockPickingType(models.Model):
@@ -16,7 +26,8 @@ class StockPickingType(models.Model):
     @api.model
     def _search(self, domain, offset=0, limit=None, order=None):
         if not self.env.su and not self.env.user.has_group('base.group_system'):
-            domain = expression.AND([domain or [], [('id', 'in', self.env.user.allowed_picking_type_ids.ids)]])
+            allowed_ids = get_allowed_ids(self.env, 'picking_type_ids', 'res_users_stock_picking_type_rel', self.env.user.id)
+            domain = expression.AND([domain or [], [('id', 'in', allowed_ids)]])
         return super()._search(domain, offset=offset, limit=limit, order=order)
 
 class StockLocation(models.Model):
@@ -25,7 +36,20 @@ class StockLocation(models.Model):
     @api.model
     def _search(self, domain, offset=0, limit=None, order=None):
         if not self.env.su and not self.env.user.has_group('base.group_system'):
-            domain = expression.AND([domain or [], [('id', 'in', self.env.user.allowed_location_ids.ids)]])
+            allowed_ids = get_allowed_ids(self.env, 'location_ids', 'res_users_stock_location_rel', self.env.user.id)
+            
+            # Robust filtering for Locations
+            # We allow:
+            # 1. Any record that is a 'parent_of' an allowed ID (to compute path names like WH/Stock)
+            # 2. Any record that is a 'child_of' an allowed ID (to allow access to bins within allowed locations)
+            # 3. Non-internal locations (Virtual/Partner) for system movements and reporting
+            restrict_domain = [
+                '|', '|',
+                ('id', 'parent_of', allowed_ids),
+                ('id', 'child_of', allowed_ids),
+                ('usage', 'not in', ['internal', 'transit'])
+            ]
+            domain = expression.AND([domain or [], restrict_domain])
         return super()._search(domain, offset=offset, limit=limit, order=order)
 
 class MrpWorkcenter(models.Model):
@@ -34,7 +58,8 @@ class MrpWorkcenter(models.Model):
     @api.model
     def _search(self, domain, offset=0, limit=None, order=None):
         if not self.env.su and not self.env.user.has_group('base.group_system'):
-            domain = expression.AND([domain or [], [('id', 'in', self.env.user.allowed_workcenter_ids.ids)]])
+            allowed_ids = get_allowed_ids(self.env, 'workcenter_ids', 'res_users_mrp_workcenter_rel', self.env.user.id)
+            domain = expression.AND([domain or [], [('id', 'in', allowed_ids)]])
         return super()._search(domain, offset=offset, limit=limit, order=order)
 
 class ApprovalCategory(models.Model):
@@ -43,5 +68,6 @@ class ApprovalCategory(models.Model):
     @api.model
     def _search(self, domain, offset=0, limit=None, order=None):
         if not self.env.su and not self.env.user.has_group('base.group_system'):
-            domain = expression.AND([domain or [], [('id', 'in', self.env.user.allowed_approval_category_ids.ids)]])
+            allowed_ids = get_allowed_ids(self.env, 'approval_category_ids', 'res_users_approval_category_rel', self.env.user.id)
+            domain = expression.AND([domain or [], [('id', 'in', allowed_ids)]])
         return super()._search(domain, offset=offset, limit=limit, order=order)
diff --git a/security/ir.model.access.csv b/security/ir.model.access.csv
new file mode 100644
index 0000000..8ec2cb7
--- /dev/null
+++ b/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_stock_valuation_layer_internal_user,stock.valuation.layer.internal.user,stock_account.model_stock_valuation_layer,base.group_user,1,0,0,0
diff --git a/security/ir_rule.xml b/security/ir_rule.xml
new file mode 100644
index 0000000..f87d7b5
--- /dev/null
+++ b/security/ir_rule.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data>
+        <!-- Permissive Rules to allow Read access, avoiding Access Errors.
+             Actual visibility restriction is handled by _search method in models/restricted_models.py. -->
+
+        <record id="stock_warehouse_permissive_rule" model="ir.rule">
+            <field name="name">Stock Warehouse Permissive Access</field>
+            <field name="model_id" ref="stock.model_stock_warehouse"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <record id="stock_picking_type_permissive_rule" model="ir.rule">
+            <field name="name">Stock Picking Type Permissive Access</field>
+            <field name="model_id" ref="stock.model_stock_picking_type"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <record id="stock_location_permissive_rule" model="ir.rule">
+            <field name="name">Stock Location Permissive Access</field>
+            <field name="model_id" ref="stock.model_stock_location"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <record id="mrp_workcenter_permissive_rule" model="ir.rule">
+            <field name="name">MRP Workcenter Permissive Access</field>
+            <field name="model_id" ref="mrp.model_mrp_workcenter"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <record id="approval_category_permissive_rule" model="ir.rule">
+            <field name="name">Approval Category Permissive Access</field>
+            <field name="model_id" ref="approvals.model_approval_category"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <!-- New rules to satisfy Inventory Reporting requirements -->
+        <record id="stock_valuation_layer_permissive_rule" model="ir.rule">
+            <field name="name">Stock Valuation Layer Permissive Access</field>
+            <field name="model_id" ref="stock_account.model_stock_valuation_layer"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <record id="stock_quant_permissive_rule" model="ir.rule">
+            <field name="name">Stock Quant Permissive Access</field>
+            <field name="model_id" ref="stock.model_stock_quant"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <record id="approval_request_permissive_rule" model="ir.rule">
+            <field name="name">Approval Request Permissive Access</field>
+            <field name="model_id" ref="approvals.model_approval_request"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+    </data>
+</odoo>