From 5d188d8fec7e52def58a564b344545b218361f4a Mon Sep 17 00:00:00 2001
From: Suherdy Yacob <suherdy.yacob@mapan.co.id>
Date: Mon, 18 May 2026 16:44:42 +0700
Subject: [PATCH] feat: implement granular security groups and restrict menu
 access for mobile app push notifications

---
 __manifest__.py                          |  1 +
 security/ir.model.access.csv             |  5 +++--
 security/mapan_loyalty_push_security.xml | 25 ++++++++++++++++++++++++
 views/app_notification_views.xml         |  6 ++++++
 wizard/push_wizard_views.xml             | 11 +++++++++++
 5 files changed, 46 insertions(+), 2 deletions(-)
 create mode 100644 security/mapan_loyalty_push_security.xml

diff --git a/__manifest__.py b/__manifest__.py
index f38fd5a..abebd69 100644
--- a/__manifest__.py
+++ b/__manifest__.py
@@ -11,6 +11,7 @@
     'version': '1.0',
     'depends': ['base', 'loyalty'],
     'data': [
+        'security/mapan_loyalty_push_security.xml',
         'security/ir.model.access.csv',
         'wizard/push_wizard_views.xml',
         'views/res_partner_views.xml',
diff --git a/security/ir.model.access.csv b/security/ir.model.access.csv
index a854d0b..b4e00f5 100644
--- a/security/ir.model.access.csv
+++ b/security/ir.model.access.csv
@@ -1,3 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_mapan_push_wizard,mapan_push_wizard,model_mapan_push_wizard,base.group_user,1,1,1,1
-access_mapan_app_notification,mapan_app_notification,model_mapan_app_notification,base.group_user,1,1,1,1
+access_mapan_push_wizard_manager,mapan_push_wizard_manager,model_mapan_push_wizard,mapan_loyalty_push.group_mapan_loyalty_push_manager,1,1,1,1
+access_mapan_app_notification_user,mapan_app_notification_user,model_mapan_app_notification,mapan_loyalty_push.group_mapan_loyalty_push_user,1,0,0,0
+access_mapan_app_notification_manager,mapan_app_notification_manager,model_mapan_app_notification,mapan_loyalty_push.group_mapan_loyalty_push_manager,1,1,1,1
diff --git a/security/mapan_loyalty_push_security.xml b/security/mapan_loyalty_push_security.xml
new file mode 100644
index 0000000..5d57339
--- /dev/null
+++ b/security/mapan_loyalty_push_security.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <record id="module_category_mapan_loyalty_push" model="ir.module.category">
+        <field name="name">Mobile App</field>
+        <field name="description">Manage Mobile App Push Notifications</field>
+        <field name="sequence">70</field>
+    </record>
+
+    <record model="res.groups.privilege" id="res_groups_privilege_mapan_loyalty_push">
+        <field name="name">Mobile App</field>
+        <field name="category_id" ref="module_category_mapan_loyalty_push"/>
+    </record>
+
+    <record id="group_mapan_loyalty_push_user" model="res.groups">
+        <field name="name">User</field>
+        <field name="privilege_id" ref="res_groups_privilege_mapan_loyalty_push"/>
+        <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="group_mapan_loyalty_push_manager" model="res.groups">
+        <field name="name">Manager</field>
+        <field name="privilege_id" ref="res_groups_privilege_mapan_loyalty_push"/>
+        <field name="implied_ids" eval="[(4, ref('group_mapan_loyalty_push_user'))]"/>
+    </record>
+</odoo>
diff --git a/views/app_notification_views.xml b/views/app_notification_views.xml
index ae00155..865a944 100644
--- a/views/app_notification_views.xml
+++ b/views/app_notification_views.xml
@@ -65,5 +65,11 @@
               name="History" 
               parent="menu_mapan_mobile_app_root" 
               action="action_mapan_app_notification_history" 
+              groups="mapan_loyalty_push.group_mapan_loyalty_push_user"
               sequence="20"/>
+
+    <!-- Explicit Menu Override to clear and reset group_ids in Database -->
+    <record id="menu_mapan_app_notification_history" model="ir.ui.menu">
+        <field name="group_ids" eval="[(6, 0, [ref('mapan_loyalty_push.group_mapan_loyalty_push_user')])]"/>
+    </record>
 </odoo>
diff --git a/wizard/push_wizard_views.xml b/wizard/push_wizard_views.xml
index 1302403..e7f5918 100644
--- a/wizard/push_wizard_views.xml
+++ b/wizard/push_wizard_views.xml
@@ -31,6 +31,7 @@
     <menuitem id="menu_mapan_mobile_app_root" 
               name="Mobile App" 
               web_icon="mapan_loyalty_push,static/description/icon.png"
+              groups="mapan_loyalty_push.group_mapan_loyalty_push_user"
               sequence="50"/>
 
     <!-- Action Menu inside the App -->
@@ -38,5 +39,15 @@
               name="Send Push Notification" 
               parent="menu_mapan_mobile_app_root" 
               action="action_mapan_push_wizard" 
+              groups="mapan_loyalty_push.group_mapan_loyalty_push_manager"
               sequence="10"/>
+
+    <!-- Explicit Menu Overrides to clear and reset group_ids in Database -->
+    <record id="menu_mapan_mobile_app_root" model="ir.ui.menu">
+        <field name="group_ids" eval="[(6, 0, [ref('mapan_loyalty_push.group_mapan_loyalty_push_user')])]"/>
+    </record>
+
+    <record id="menu_mapan_push_wizard" model="ir.ui.menu">
+        <field name="group_ids" eval="[(6, 0, [ref('mapan_loyalty_push.group_mapan_loyalty_push_manager')])]"/>
+    </record>
 </odoo>