fix(roles): OP#951 round-2 - tighten ACLs and gate management buttons

- Add cycle/cycle_membership read ACLs for spp_registry.group_registry_viewer
  so Global Registrar and CR Validator HQ can open Individual/Group forms
  without spp.cycle access errors.
- Service Points: registry_write ACL becomes read-only; Disable/Enable
  buttons gated to officer/manager. Registrars see read-only form, no
  create/edit, no Disable.
- form_controller_create.js: also hide "New" when this.canCreate === false
  so the form-view "New" button respects ACL on models where Odoo 19's
  t-if="canCreate" leaks through (e.g. service points).
- Individual/Group Disable/Enable buttons gated to registry_manager only
  (was officer+manager). Hides for Farm User, Farm Manager, Support
  Manager, Registrars, Viewers.
- Apply Compliance Criteria button gated to group_programs_manager.
- Global Finance role: add group_programs_viewer for full Programs menu;
  remove group_programs_validator from program-management buttons
  (import/enroll eligible, verify_eligibility, create_new_cycle,
  copy_beneficiaries, action_prepare_entitlement, mark_ended,
  mark_cancelled) so Finance keeps payments/entitlement-approval scope
  only.

Author: emjay0921

spp_programs/data/user_roles.xml

@@ -47,12 +47,18 @@
     </record>
 
     <!-- Finance -->
+    <!--
+        Per OP#951 round-2: Finance role needs read on the full Programs menu
+        (programs / cycles / entitlements) on top of validator rights for
+        payment batches. group_programs_viewer is Tier-2 (gates the menu).
+    -->
     <record id="spp_user_roles.global_role_finance" model="res.users.role">
         <field
             name="implied_ids"
             eval="
             [
                 Command.link(ref('spp_programs.group_programs_validator')),
+                Command.link(ref('spp_programs.group_programs_viewer')),
             ]"
         />
     </record>

spp_programs/security/ir.model.access.csv

@@ -107,6 +107,8 @@ access_spp_program_membership_registry_read,Program Membership Registry Read Acc
 access_spp_program_membership_registry_write,Program Membership Registry Write Access,spp_programs.model_spp_program_membership,spp_registry.group_registry_write,1,1,1,0
 access_spp_program_membership_registrar,Program Membership Registrar Access,spp_programs.model_spp_program_membership,spp_registry.group_registry_officer,1,1,1,0
 access_spp_cycle_membership_registrar,Cycle Membership Registrar Access,spp_programs.model_spp_cycle_membership,spp_registry.group_registry_officer,1,1,1,0
+access_spp_cycle_registry_viewer,Cycle Registry Viewer Read,spp_programs.model_spp_cycle,spp_registry.group_registry_viewer,1,0,0,0
+access_spp_cycle_membership_registry_viewer,Cycle Membership Registry Viewer Read,spp_programs.model_spp_cycle_membership,spp_registry.group_registry_viewer,1,0,0,0
 access_spp_entitlement_registry_read,Entitlement Registry Read Access,spp_programs.model_spp_entitlement,spp_registry.group_registry_read,1,0,0,0
 access_spp_entitlement_registry_write,Entitlement Registry Write Access,spp_programs.model_spp_entitlement,spp_registry.group_registry_write,1,1,1,0
 access_spp_entitlement_registrar,Entitlement Registrar Access,spp_programs.model_spp_entitlement,spp_registry.group_registry_officer,1,0,0,0

spp_programs/static/src/js/form_controller_create.js

@@ -5,19 +5,24 @@ import {patch} from "@web/core/utils/patch";
 import {onMounted, onPatched, onWillUnmount} from "@odoo/owl";
 
 /**
- * Patch FormController to respect context.create = false and disable create
- * for specific models (entitlements).
+ * Patch FormController to hide the form "New" button when the user lacks
+ * create permission, or for models where create is contextually forbidden.
  *
- * In Odoo 19, the "New" button may still appear in various scenarios:
- * - When navigating from list to form view with context.create = false
- * - When expanding a dialog (creates a new action without preserving context)
+ * In Odoo 19, `t-if="canCreate"` on the form template does not always prevent
+ * the "New" button from rendering — notably the breadcrumb-area button can
+ * leak through when the form arch was first loaded as a privileged user and
+ * cached, or in some action navigation flows. This patch enforces hiding via
+ * DOM manipulation for:
  *
- * This patch hides the New button via DOM manipulation for:
- * 1. Any view with context.create === false
- * 2. Entitlement models (should only be created from cycles)
+ * 1. Any view with `context.create === false`.
+ * 2. Models in MODELS_WITHOUT_CREATE (always-hide; never should be created
+ *    directly from the form, e.g. entitlements).
+ * 3. `this.canCreate === false` — i.e. the ACL-derived archInfo.activeActions
+ *    .create is false. This is the ACL-aware path that preserves the button
+ *    for users who DO have create permission.
  */
 
-// Models that should never show the create button
+// Models that should never show the create button regardless of ACL
 const MODELS_WITHOUT_CREATE = [
     "spp.entitlement",
     "spp.entitlement.inkind",
@@ -33,7 +38,8 @@ patch(FormController.prototype, {
         const modelName = this.props.resModel;
         const shouldHideCreate =
             this.props.context?.create === false ||
-            MODELS_WITHOUT_CREATE.includes(modelName);
+            MODELS_WITHOUT_CREATE.includes(modelName) ||
+            this.canCreate === false;
 
         if (shouldHideCreate) {
             this._hideCreateObserver = null;

spp_programs/views/cycle_compliance_view.xml

@@ -18,6 +18,7 @@
                     class="btn-warning"
                     confirm="Filtering is a one-way action. Are you sure you want to apply compliance criteria?"
                     invisible="not allow_filter_compliance_criteria or compliance_criteria_applied"
+                    groups="spp_programs.group_programs_manager"
                 />
                 <field name="allow_filter_compliance_criteria" invisible="1" />
                 <field name="compliance_criteria_applied" invisible="1" />

spp_programs/views/cycle_view.xml

@@ -134,15 +134,15 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details.
                         string="Copy Beneficiaries"
                         icon="fa-copy"
                         invisible="state != 'draft'"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer"
                     />
                     <button
                         name="action_prepare_entitlement"
                         type="object"
                         string="Prepare Entitlements"
                         icon="fa-list"
                         invisible="state not in ('draft', 'to_approve') or total_entitlements_count > 0"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer"
                     />
                     <button
                         name="action_submit_for_approval"
@@ -218,15 +218,15 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details.
                         string="End Cycle"
                         icon="fa-stop"
                         invisible="state not in ('approved', 'distributed')"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager"
                     />
                     <button
                         name="mark_cancelled"
                         type="object"
                         string="Cancel"
                         icon="fa-times"
                         invisible="state in ('ended', 'cancelled')"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager"
                     />
                     <field
                         name="state"

spp_programs/views/programs_view.xml

@@ -99,7 +99,7 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details.
                         icon="fa-download"
                         class="btn-secondary"
                         invisible="state != 'active'"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer"
                     />
                     <button
                         name="enroll_eligible_registrants"
@@ -108,23 +108,23 @@ Part of OpenSPP. See LICENSE file for full copyright and licensing details.
                         icon="fa-user-plus"
                         class="btn-primary"
                         invisible="state != 'active'"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer"
                     />
                     <button
                         name="verify_eligibility"
                         type="object"
                         string="Verify Eligibility"
                         icon="fa-check-circle"
                         invisible="state != 'active'"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer"
                     />
                     <button
                         name="create_new_cycle"
                         type="object"
                         string="New Cycle"
                         icon="fa-plus-circle"
                         invisible="state != 'active' or is_one_time_distribution"
-                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer,spp_programs.group_programs_validator"
+                        groups="spp_security.group_spp_admin,spp_programs.group_programs_manager,spp_programs.group_programs_officer"
                     />
                     <button
                         name="deduplicate_beneficiaries"

spp_registry/views/individual_views.xml

@@ -136,28 +136,28 @@
             <xpath expr="//sheet" position="replace">
                 <sheet>
                     <div name="button_box">
-                        <!-- Disable button - restricted to officers/managers -->
+                        <!-- Disable button - restricted to registry managers only -->
                         <button
                             type="action"
                             class="oe_stat_button"
                             icon="fa-ban"
                             name="%(spp_registry.action_disable_registrant_wizard)d"
                             invisible="disabled"
-                            groups="spp_registry.group_registry_officer,spp_registry.group_registry_manager"
+                            groups="spp_registry.group_registry_manager"
                             title="Disable"
                         >
                             <div class="o_form_field o_stat_info">
                                 <span class="o_stat_text">Disable</span>
                             </div>
                         </button>
-                        <!-- Enable button - restricted to officers/managers -->
+                        <!-- Enable button - restricted to registry managers only -->
                         <button
                             type="object"
                             class="oe_stat_button"
                             icon="fa-check"
                             name="enable_registrant"
                             invisible="not disabled"
-                            groups="spp_registry.group_registry_officer,spp_registry.group_registry_manager"
+                            groups="spp_registry.group_registry_manager"
                             title="Enable"
                         >
                             <div class="o_form_field o_stat_info">

spp_service_points/security/ir.model.access.csv

@@ -10,4 +10,4 @@ access_spp_service_point_manager,spp.service.point manager,spp_service_points.mo
 access_spp_service_point_user,Service Point User Access (Deprecated),spp_service_points.model_spp_service_point,spp_service_points.group_service_points_user,1,1,1,0
 
 access_spp_service_point_registry_read,Service Point Registry Read Access,spp_service_points.model_spp_service_point,spp_registry.group_registry_read,1,0,0,0
-access_spp_service_point_registry_write,Service Point Registry Write Access,spp_service_points.model_spp_service_point,spp_registry.group_registry_write,1,1,1,0
+access_spp_service_point_registry_write,Service Point Registry Write Access,spp_service_points.model_spp_service_point,spp_registry.group_registry_write,1,0,0,0

spp_service_points/views/service_points_view.xml

@@ -51,6 +51,7 @@
                         string="Enable Service Point"
                         class="btn-success"
                         invisible="not is_disabled or not id"
+                        groups="spp_service_points.group_service_points_officer,spp_service_points.group_service_points_manager"
                         confirm="Enable this service point? It will become active again."
                     />
                     <button
@@ -59,6 +60,7 @@
                         string="Disable Service Point"
                         class="btn-warning"
                         invisible="is_disabled or not id"
+                        groups="spp_service_points.group_service_points_officer,spp_service_points.group_service_points_manager"
                         confirm="Disable this service point? You will need to provide a reason."
                     />
                 </header>