[18.0][ADD] base_report_manager

base_report_manager/README.rst

@@ -0,0 +1,116 @@
+===================
+Base Report Manager
+===================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:1e773c2fd37965ea5dfe074cf4596b46264cc1d4ba558180fa6377a20c0e1dca
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
+    :alt: License: AGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--ux-lightgray.png?logo=github
+    :target: https://github.com/OCA/server-ux/tree/18.0/base_report_manager
+    :alt: OCA/server-ux
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/server-ux-18-0/server-ux-18-0-base_report_manager
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-ux&target_branch=18.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module provides granular visibility control over PDF and QWeb
+Reports based on User Groups:
+
+1. It introduces the ability to configure "Restricted Report Actions"
+   directly within Odoo Security Groups.
+2. It enforces a "Restricted / Deny List" policy, ensuring that users
+   cannot view or print reports that are restricted for any of their
+   assigned groups (either directly or transitively inherited).
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Configuration
+=============
+
+To configure report restrictions:
+
+1. Go to **Settings > Users & Companies > Groups** and select the Group
+   you want to configure.
+2. Under the **Restricted Report Actions** tab, select the report
+   actions you want to hide from members of this group.
+
+Note: Group privilege inheritance is transitive. If a report action is
+restricted for a group, that restriction propagates to all users who
+belong to the group, including those who inherit the group (e.g.,
+restricting a lower-privilege group like "User" will also restrict a
+higher-privilege group like "Manager" that implies/inherits it).
+
+Usage
+=====
+
+Once report restrictions are configured for user groups:
+
+1. Assign the appropriate groups to the user.
+2. The user navigates to the target model view (e.g., Partners).
+3. Under the **Print** action menu, any report that is restricted for
+   the user's groups will be hidden. All other reports remain visible.
+
+Known issues / Roadmap
+======================
+
+- None.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-ux/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/server-ux/issues/new?body=module:%20base_report_manager%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* CIT Services
+
+Contributors
+------------
+
+- `CIT-Services <cit-services.eu>`__
+
+  - Prayag <prayag.k@cit-services.eu>
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+This module is part of the `OCA/server-ux <https://github.com/OCA/server-ux/tree/18.0/base_report_manager>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

base_report_manager/__init__.py

@@ -0,0 +1,4 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from . import models

base_report_manager/__manifest__.py

@@ -0,0 +1,17 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+{
+    "name": "Base Report Manager",
+    "summary": "Manage report actions visibility per user group",
+    "version": "18.0.1.0.0",
+    "category": "Tools",
+    "author": "CIT Services, Odoo Community Association (OCA)",
+    "website": "https://github.com/OCA/server-ux",
+    "license": "AGPL-3",
+    "installable": True,
+    "depends": ["base"],
+    "data": [
+        "views/res_groups_views.xml",
+    ],
+}

base_report_manager/models/__init__.py

@@ -0,0 +1,5 @@
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from . import res_groups
+from . import ir_actions_actions
+from . import ir_actions_report

base_report_manager/models/ir_actions_actions.py

@@ -0,0 +1,35 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from odoo import api, models
+
+
+class IrActionsActions(models.Model):
+    _inherit = "ir.actions.actions"
+
+    @api.model
+    def get_bindings(self, model_name):
+        """Filter out restricted reports from print sidebar and bindings."""
+        result = super().get_bindings(model_name)
+        if self.env.is_superuser():
+            return result
+        if "report" in result:
+            report_ids = list(map(lambda rep: rep.get("id"), result["report"]))
+            if reports := self.env["ir.actions.report"].browse(report_ids):
+                restricted_report_ids = [
+                    report.id
+                    for report in reports
+                    if report._is_action_report_restricted()
+                ]
+                if restricted_report_ids:
+                    result["report"] = list(
+                        filter(
+                            lambda rep: rep
+                            if rep.get("id") not in restricted_report_ids
+                            else {},
+                            result["report"],
+                        )
+                    )
+                    if not result.get("report", False):
+                        result.pop("report")
+        return result

base_report_manager/models/ir_actions_report.py

@@ -0,0 +1,36 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from odoo import _, models
+from odoo.exceptions import AccessError
+
+
+class IrActionsReport(models.Model):
+    _inherit = "ir.actions.report"
+
+    def _is_action_report_restricted(self):
+        """Returns True if the current action is restricted for the current user,
+        taking group privilege inheritance into account.
+        """
+        self.ensure_one()
+        if self.env.is_superuser():
+            return False
+
+        user_groups = self.env.user.sudo().groups_id
+        return self.sudo().id in user_groups.restricted_report_action_ids.ids
+
+    def _check_action_report_restrictions(self):
+        """Raises AccessError if any action in self is restricted."""
+        for action in self:
+            if action._is_action_report_restricted():
+                raise AccessError(
+                    _(
+                        "You are not allowed to access this action because it "
+                        "is restricted for one of your user groups."
+                    )
+                )
+
+    def _get_action_dict(self):
+        """Verify restrictions before loading action details for execution."""
+        self._check_action_report_restrictions()
+        return super()._get_action_dict()

base_report_manager/models/res_groups.py

@@ -0,0 +1,17 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from odoo import fields, models
+
+
+class ResGroups(models.Model):
+    _inherit = "res.groups"
+
+    restricted_report_action_ids = fields.Many2many(
+        comodel_name="ir.actions.report",
+        relation="res_groups_restricted_report_action_rel",
+        column1="gid",
+        column2="act_id",
+        string="Restricted Report Actions",
+        help="Report actions restricted for members of this group.",
+    )

base_report_manager/pyproject.toml

@@ -0,0 +1,3 @@
+[build-system]
+requires = ["whool"]
+build-backend = "whool.buildapi"

base_report_manager/readme/CONFIGURE.md

@@ -0,0 +1,7 @@
+To configure report restrictions:
+
+1. Go to **Settings > Users & Companies > Groups** and select the Group you want to configure.
+2. Under the **Restricted Report Actions** tab, select the report actions you want to hide from members of this group.
+
+Note: Group privilege inheritance is transitive. If a report action is restricted for a group, that restriction propagates to all users who belong to the group, including those who inherit the group (e.g., restricting a lower-privilege group like "User" will also restrict a higher-privilege group like "Manager" that implies/inherits it).
+

base_report_manager/readme/CONTRIBUTORS.md

@@ -0,0 +1,2 @@
+- [CIT-Services](cit-services.eu)
+  - Prayag \<<prayag.k@cit-services.eu>\>

base_report_manager/readme/DESCRIPTION.md

@@ -0,0 +1,5 @@
+This module provides granular visibility control over PDF and QWeb Reports based on User Groups:
+
+1. It introduces the ability to configure "Restricted Report Actions" directly within Odoo Security Groups.
+2. It enforces a "Restricted / Deny List" policy, ensuring that users cannot view or print reports that are restricted for any of their assigned groups (either directly or transitively inherited).
+

base_report_manager/readme/ROADMAP.md

@@ -0,0 +1 @@
+- None.

base_report_manager/readme/USAGE.md

@@ -0,0 +1,5 @@
+Once report restrictions are configured for user groups:
+
+1. Assign the appropriate groups to the user.
+2. The user navigates to the target model view (e.g., Partners).
+3. Under the **Print** action menu, any report that is restricted for the user's groups will be hidden. All other reports remain visible.