[IMP] base_duplicate_security_group: add duplicate restriction for list view

The security group restriction was only applied to the form view duplicate
button, leaving a security gap: users without the "Duplicate" permission
could still duplicate records by selecting them in list view and using the
"Duplicate" action.

This patch extends the protection to list view by patching ListController
to disable the duplicate action for users without permission. Tours and
HttpCase tests verify both allowed and forbidden scenarios.

The refactoring extracts the permission check into a common disableDuplicate()
function to ensure consistency across both form and list views.

Author: jorgevalmalanetkia

base_duplicate_security_group/README.rst

@@ -39,13 +39,18 @@ of the duplicate records function or not.
 Configuration
 =============
 
-To allow users to duplicate records from the form view dropdown:
+To allow users to duplicate records from the user interface:
 
 1. Go to Settings > Users > Groups.
 2. Search for the *Duplicate records* group.
 3. Add or remove the users that are allowed or not to duplicate records
    via UI.
 
+This restriction applies to:
+
+- **Form view**: Duplicate button in the Action menu
+- **List view**: Duplicate action when selecting records
+
 Bug Tracker
 ===========
 

base_duplicate_security_group/__manifest__.py

@@ -3,14 +3,14 @@
 {
     "name": "Restrict records duplicating",
     "summary": "Adds a security group to restrict which users can copy records",
-    "version": "18.0.1.0.0",
+    "version": "18.0.1.1.0",
     "development_status": "Beta",
     "category": "Server tools",
     "website": "https://github.com/OCA/server-ux",
     "author": "Tecnativa, Odoo Community Association (OCA)",
     "maintainers": ["chienandalu"],
     "license": "AGPL-3",
-    "depends": ["web_tour"],
+    "depends": ["web", "web_tour"],
     "data": ["security/base_duplicate_security_group_security.xml"],
     "assets": {
         "web.assets_backend": [

base_duplicate_security_group/readme/CONFIGURE.md

@@ -1,6 +1,11 @@
-To allow users to duplicate records from the form view dropdown:
+To allow users to duplicate records from the user interface:
 
 1.  Go to Settings \> Users \> Groups.
 2.  Search for the *Duplicate records* group.
 3.  Add or remove the users that are allowed or not to duplicate records
     via UI.
+
+This restriction applies to:
+
+-   **Form view**: Duplicate button in the Action menu
+-   **List view**: Duplicate action when selecting records

base_duplicate_security_group/static/description/index.html

@@ -387,13 +387,18 @@ <h1 class="title">Restrict records duplicating</h1>
 </div>
 <div class="section" id="configuration">
 <h1><a class="toc-backref" href="#toc-entry-1">Configuration</a></h1>
-<p>To allow users to duplicate records from the form view dropdown:</p>
+<p>To allow users to duplicate records from the user interface:</p>
 <ol class="arabic simple">
 <li>Go to Settings &gt; Users &gt; Groups.</li>
 <li>Search for the <em>Duplicate records</em> group.</li>
 <li>Add or remove the users that are allowed or not to duplicate records
 via UI.</li>
 </ol>
+<p>This restriction applies to:</p>
+<ul class="simple">
+<li><strong>Form view</strong>: Duplicate button in the Action menu</li>
+<li><strong>List view</strong>: Duplicate action when selecting records</li>
+</ul>
 </div>
 <div class="section" id="bug-tracker">
 <h1><a class="toc-backref" href="#toc-entry-2">Bug Tracker</a></h1>

base_duplicate_security_group/static/src/js/duplicate.esm.js

@@ -3,20 +3,35 @@
    License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
 */
 import {FormController} from "@web/views/form/form_controller";
+import {ListController} from "@web/views/list/list_controller";
 import {patch} from "@web/core/utils/patch";
 import {user} from "@web/core/user";
 
+const GROUP_DUPLICATE = "base_duplicate_security_group.group_duplicate_records";
+
 /**
- * Patch FormController to disable duplicate action for users without permission.
+ * Disable duplicate action for users without permission in both Form and List views.
  * If the user has the permission, the internal logic rules will apply.
  **/
+async function disableDuplicate(controller) {
+    const hasGroup = await user.hasGroup(GROUP_DUPLICATE);
+    if (!hasGroup && controller.archInfo.activeActions) {
+        controller.archInfo.activeActions.duplicate = false;
+    }
+}
+
+// Patch FormController - duplicate button in form view
 patch(FormController.prototype, {
     async setup() {
         await super.setup(...arguments);
-        const base_group = "base_duplicate_security_group.group_duplicate_records";
-        const hasGroup = await user.hasGroup(base_group);
-        if (!hasGroup && this.archInfo.activeActions) {
-            this.archInfo.activeActions.duplicate = false;
-        }
+        await disableDuplicate(this);
+    },
+});
+
+// Patch ListController - duplicate action on selected records
+patch(ListController.prototype, {
+    async setup() {
+        await super.setup(...arguments);
+        await disableDuplicate(this);
     },
 });

base_duplicate_security_group/static/src/js/tour_duplicate.esm.js

@@ -7,26 +7,40 @@ import {registry} from "@web/core/registry";
 const commonSteps = [
     {
         trigger: ".o_navbar_apps_menu > button.dropdown-toggle",
+        run: "click",
     },
     {
         content: "Open the settings menu",
         trigger: '[data-menu-xmlid="base.menu_administration"]',
+        run: "click",
     },
     {
         content: "Open the Users and Companies menu",
-        trigger: '.dropdown-toggle[data-menu-xmlid="base.menu_users"]',
+        trigger: '[data-menu-xmlid="base.menu_users"]',
+        run: "click",
     },
     {
         content: "Open the users menu option",
-        trigger: '.dropdown-item[data-menu-xmlid="base.menu_action_res_users"]',
+        trigger: '[data-menu-xmlid="base.menu_action_res_users"]',
+        run: "click",
+    },
+    {
+        content: "Wait for users list",
+        trigger: ".o_list_view",
     },
     {
         content: "Choose a user",
-        trigger: ".o_data_cell:contains('Demo')",
+        trigger: ".o_data_cell",
+        run: "click",
     },
     {
-        content: "Pull the actions dropdown",
-        trigger: "button.dropdown-toggle:contains('Action')",
+        content: "Wait for form view to load",
+        trigger: ".o_form_view",
+    },
+    {
+        content: "Open Action menu",
+        trigger: ".o_cp_action_menus button",
+        run: "click",
     },
 ];
 
@@ -37,7 +51,11 @@ registry.category("web_tour.tours").add("button_duplicate_ok", {
         ...commonSteps,
         {
             content: "We can duplicate",
-            trigger: "a[role='menuitemcheckbox']:contains('Duplicate')",
+            trigger:
+                ".dropdown-menu .dropdown-item:contains('Duplicate'), " +
+                ".dropdown-menu button:contains('Duplicate'), " +
+                ".dropdown-menu a:contains('Duplicate')",
+            run: "click",
         },
     ],
 });
@@ -48,8 +66,9 @@ registry.category("web_tour.tours").add("button_duplicate_ko", {
     steps: () => [
         ...commonSteps,
         {
+            content: "We cannot duplicate",
             trigger:
-                ".btn-group:not(:has(a[role='menuitemcheckbox']:contains('Duplicate')))",
+                ".dropdown-menu:not(:has(.dropdown-item:contains('Duplicate'))):not(:has(button:contains('Duplicate'))):not(:has(a:contains('Duplicate')))",
         },
     ],
 });

base_duplicate_security_group/tests/test_base_duplicate_security_group.py

@@ -5,10 +5,19 @@
 
 @tagged("-at_install", "post_install")
 class TestDuplicateSecurityGroup(HttpCase):
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        cls.group_duplicate = cls.env.ref(
+            "base_duplicate_security_group.group_duplicate_records"
+        )
+        cls.admin_user = cls.env.ref("base.user_admin")
+
     def test_duplicate_button(self):
-        """Whether or not the duplicate button is available
+        """Test duplicate button availability in form view.
         The button should be accessible depending on the user permissions."""
         self.start_tour("web", "button_duplicate_ok", login="admin")
-        group = self.env.ref("base_duplicate_security_group.group_duplicate_records")
-        group.users -= self.env.ref("base.user_admin")
+        self.group_duplicate.users -= self.admin_user
         self.start_tour("web", "button_duplicate_ko", login="admin")
+        # Restore permissions for other tests
+        self.group_duplicate.users |= self.admin_user