fix(spp_approval,spp_dci_client): add auto=True to system approval and fix test log ordering

Pass auto=True to _do_approve in _action_approve_system so automated approvals
show "(auto)" in activity feedback and skip submitter notification, matching the
intent of system-initiated approvals.

Fix reversed log assertions in test_401_retry_creates_two_log_entries: due to
try-finally semantics with recursive calls, the inner retry's finally creates
the success log first (lower ID), so with order="id desc" logs[0] is the 401
entry and logs[1] is the success entry.

Author: jeremi

spp_approval/models/approval_mixin.py

@@ -356,7 +356,7 @@ def _action_approve_system(self, comment=None):
                     record.approval_state,
                 )
                 continue
-            record.sudo()._do_approve(comment=comment)
+            record.sudo()._do_approve(comment=comment, auto=True)  # nosemgrep: odoo-sudo-without-context
             _logger.info(
                 "System auto-approved %s %s: %s",
                 record._name,

spp_dci_client/models/data_source.py

@@ -327,7 +327,7 @@ def get_oauth2_token(self, force_refresh=False):
 
         try:
             # Use sudo() to access OAuth2 credentials which are restricted to administrators
-            sudo_self = self.sudo()
+            sudo_self = self.sudo()  # nosemgrep: odoo-sudo-without-context
             token_data = {
                 "grant_type": "client_credentials",
                 "client_id": sudo_self.oauth2_client_id,

spp_dci_client/tests/test_outgoing_log_integration.py

@@ -392,16 +392,19 @@ def test_401_retry_creates_two_log_entries(self, mock_client_class):
         )
         self.assertEqual(len(logs), 2, "Should have two log entries (401 + retry)")
 
-        # Most recent should be the retry success
-        self.assertEqual(logs[0].status, "success")
-        self.assertEqual(logs[0].response_status_code, 200)
-
-        # Earlier should be the 401 error
-        self.assertEqual(logs[1].status, "http_error")
-        self.assertEqual(logs[1].response_status_code, 401)
-        self.assertIn("retrying", logs[1].error_detail.lower())
+        # With order="id desc", logs[0] has the highest ID (created last).
+        # Due to try-finally semantics, the recursive retry's finally runs first
+        # (lower ID = success), then the outer call's finally runs (higher ID = 401).
+        # So logs[0] (highest ID) is the 401 entry, logs[1] (lower ID) is the success.
+        self.assertEqual(logs[0].status, "http_error")
+        self.assertEqual(logs[0].response_status_code, 401)
+        self.assertIn("retrying", logs[0].error_detail.lower())
         # M-1 fix: 401 response body should be captured
-        self.assertTrue(logs[1].response_summary)
+        self.assertTrue(logs[0].response_summary)
+
+        # Earlier log (lower ID) is the retry success
+        self.assertEqual(logs[1].status, "success")
+        self.assertEqual(logs[1].response_status_code, 200)
 
     @patch("httpx.Client")
     def test_log_failure_does_not_block_request(self, mock_client_class):