[ADD] base_duplicate_security_group: Add duplicate restriction for list view

- Patch ListController to disable duplicate action for users without permission
- Add tours for list view duplicate action testing (ok/ko scenarios)
- Add HttpCase tests for list view duplicate action
- Bump version to 18.0.1.1.0 (new feature)
- Refactor: Extract common permission check to disableDuplicate() function

This ensures the security group restriction applies consistently to:
- Form view: duplicate button in action menu
- List view: duplicate action when selecting records

The module now provides complete protection against unauthorized
record duplication across all standard Odoo views.

Author: jorgevalmalanetkia

base_duplicate_security_group/README.rst

@@ -39,13 +39,18 @@ of the duplicate records function or not.
 Configuration
 =============
 
-To allow users to duplicate records from the form view dropdown:
+To allow users to duplicate records from the user interface:
 
 1. Go to Settings > Users > Groups.
 2. Search for the *Duplicate records* group.
 3. Add or remove the users that are allowed or not to duplicate records
    via UI.
 
+This restriction applies to:
+
+- **Form view**: Duplicate button in the Action menu
+- **List view**: Duplicate action when selecting records
+
 Bug Tracker
 ===========
 

base_duplicate_security_group/__manifest__.py

@@ -3,14 +3,14 @@
 {
     "name": "Restrict records duplicating",
     "summary": "Adds a security group to restrict which users can copy records",
-    "version": "18.0.1.0.1",
+    "version": "18.0.1.1.0",
     "development_status": "Beta",
     "category": "Server tools",
     "website": "https://github.com/OCA/server-ux",
     "author": "Tecnativa, Odoo Community Association (OCA)",
     "maintainers": ["chienandalu"],
     "license": "AGPL-3",
-    "depends": ["web_tour"],
+    "depends": ["web", "web_tour"],
     "data": ["security/base_duplicate_security_group_security.xml"],
     "assets": {
         "web.assets_backend": [

base_duplicate_security_group/readme/CONFIGURE.md

@@ -1,6 +1,11 @@
-To allow users to duplicate records from the form view dropdown:
+To allow users to duplicate records from the user interface:
 
 1.  Go to Settings \> Users \> Groups.
 2.  Search for the *Duplicate records* group.
 3.  Add or remove the users that are allowed or not to duplicate records
     via UI.
+
+This restriction applies to:
+
+-   **Form view**: Duplicate button in the Action menu
+-   **List view**: Duplicate action when selecting records

base_duplicate_security_group/static/description/index.html

@@ -387,13 +387,18 @@ <h1 class="title">Restrict records duplicating</h1>
 </div>
 <div class="section" id="configuration">
 <h1><a class="toc-backref" href="#toc-entry-1">Configuration</a></h1>
-<p>To allow users to duplicate records from the form view dropdown:</p>
+<p>To allow users to duplicate records from the user interface:</p>
 <ol class="arabic simple">
 <li>Go to Settings &gt; Users &gt; Groups.</li>
 <li>Search for the <em>Duplicate records</em> group.</li>
 <li>Add or remove the users that are allowed or not to duplicate records
 via UI.</li>
 </ol>
+<p>This restriction applies to:</p>
+<ul class="simple">
+<li><strong>Form view</strong>: Duplicate button in the Action menu</li>
+<li><strong>List view</strong>: Duplicate action when selecting records</li>
+</ul>
 </div>
 <div class="section" id="bug-tracker">
 <h1><a class="toc-backref" href="#toc-entry-2">Bug Tracker</a></h1>

base_duplicate_security_group/static/src/js/duplicate.esm.js

@@ -3,20 +3,35 @@
    License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
 */
 import {FormController} from "@web/views/form/form_controller";
+import {ListController} from "@web/views/list/list_controller";
 import {patch} from "@web/core/utils/patch";
 import {user} from "@web/core/user";
 
+const GROUP_DUPLICATE = "base_duplicate_security_group.group_duplicate_records";
+
 /**
- * Patch FormController to disable duplicate action for users without permission.
+ * Disable duplicate action for users without permission in both Form and List views.
  * If the user has the permission, the internal logic rules will apply.
  **/
+async function disableDuplicate(controller) {
+    const hasGroup = await user.hasGroup(GROUP_DUPLICATE);
+    if (!hasGroup && controller.archInfo.activeActions) {
+        controller.archInfo.activeActions.duplicate = false;
+    }
+}
+
+// Patch FormController - duplicate button in form view
 patch(FormController.prototype, {
     async setup() {
         await super.setup(...arguments);
-        const base_group = "base_duplicate_security_group.group_duplicate_records";
-        const hasGroup = await user.hasGroup(base_group);
-        if (!hasGroup && this.archInfo.activeActions) {
-            this.archInfo.activeActions.duplicate = false;
-        }
+        await disableDuplicate(this);
+    },
+});
+
+// Patch ListController - duplicate action on selected records
+patch(ListController.prototype, {
+    async setup() {
+        await super.setup(...arguments);
+        await disableDuplicate(this);
     },
 });

base_duplicate_security_group/static/src/js/tour_duplicate.esm.js

@@ -7,26 +7,40 @@ import {registry} from "@web/core/registry";
 const commonSteps = [
     {
         trigger: ".o_navbar_apps_menu > button.dropdown-toggle",
+        run: "click",
     },
     {
         content: "Open the settings menu",
         trigger: '[data-menu-xmlid="base.menu_administration"]',
+        run: "click",
     },
     {
         content: "Open the Users and Companies menu",
-        trigger: '.dropdown-toggle[data-menu-xmlid="base.menu_users"]',
+        trigger: '[data-menu-xmlid="base.menu_users"]',
+        run: "click",
     },
     {
         content: "Open the users menu option",
-        trigger: '.dropdown-item[data-menu-xmlid="base.menu_action_res_users"]',
+        trigger: '[data-menu-xmlid="base.menu_action_res_users"]',
+        run: "click",
+    },
+    {
+        content: "Wait for users list",
+        trigger: ".o_list_view",
     },
     {
         content: "Choose a user",
-        trigger: ".o_data_cell:contains('Demo')",
+        trigger: ".o_data_cell",
+        run: "click",
     },
     {
-        content: "Pull the actions dropdown",
-        trigger: "button.dropdown-toggle:contains('Action')",
+        content: "Wait for form view to load",
+        trigger: ".o_form_view",
+    },
+    {
+        content: "Open Action menu",
+        trigger: ".o_cp_action_menus button",
+        run: "click",
     },
 ];
 
@@ -37,7 +51,11 @@ registry.category("web_tour.tours").add("button_duplicate_ok", {
         ...commonSteps,
         {
             content: "We can duplicate",
-            trigger: "a[role='menuitemcheckbox']:contains('Duplicate')",
+            trigger:
+                ".dropdown-menu .dropdown-item:contains('Duplicate'), " +
+                ".dropdown-menu button:contains('Duplicate'), " +
+                ".dropdown-menu a:contains('Duplicate')",
+            run: "click",
         },
     ],
 });
@@ -48,8 +66,9 @@ registry.category("web_tour.tours").add("button_duplicate_ko", {
     steps: () => [
         ...commonSteps,
         {
+            content: "We cannot duplicate",
             trigger:
-                ".btn-group:not(:has(a[role='menuitemcheckbox']:contains('Duplicate')))",
+                ".dropdown-menu:not(:has(.dropdown-item:contains('Duplicate'))):not(:has(button:contains('Duplicate'))):not(:has(a:contains('Duplicate')))",
         },
     ],
 });

base_duplicate_security_group/tests/test_base_duplicate_security_group.py

@@ -5,10 +5,19 @@
 
 @tagged("-at_install", "post_install")
 class TestDuplicateSecurityGroup(HttpCase):
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        cls.group_duplicate = cls.env.ref(
+            "base_duplicate_security_group.group_duplicate_records"
+        )
+        cls.admin_user = cls.env.ref("base.user_admin")
+
     def test_duplicate_button(self):
-        """Whether or not the duplicate button is available
+        """Test duplicate button availability in form view.
         The button should be accessible depending on the user permissions."""
         self.start_tour("web", "button_duplicate_ok", login="admin")
-        group = self.env.ref("base_duplicate_security_group.group_duplicate_records")
-        group.users -= self.env.ref("base.user_admin")
+        self.group_duplicate.users -= self.admin_user
         self.start_tour("web", "button_duplicate_ko", login="admin")
+        # Restore permissions for other tests
+        self.group_duplicate.users |= self.admin_user