fix(spp_approval,spp_dci_client): prevent RPC exposure of system approval and narrow exception handling

Rename action_approve_system to _action_approve_system to prevent Odoo
from exposing it via the RPC interface, since it uses sudo() and skips
_check_can_approve() authorization checks.

Replace broad Exception catches in spp_dci_client with specific exception
types (json.JSONDecodeError, KeyError, TypeError) and add json import.

Author: jeremi

spp_approval/models/approval_mixin.py

@@ -332,7 +332,7 @@ def action_approve(self, comment=None):
             record._check_can_approve()
             record._do_approve(comment=comment)
 
-    def action_approve_system(self, comment=None):
+    def _action_approve_system(self, comment=None):
         """System-initiated approval bypassing user permission checks.
 
         Use this for automated approvals triggered by system events (e.g., DCI
@@ -341,6 +341,9 @@ def action_approve_system(self, comment=None):
         This method uses sudo() to bypass access controls and skips the
         _check_can_approve() permission validation.
 
+        The underscore prefix is intentional — it prevents this method from being
+        callable via Odoo's RPC interface, since it must not be exposed to users.
+
         Args:
             comment: Optional approval comment for audit trail
         """
@@ -392,7 +395,7 @@ def _do_approve(self, comment=None, auto=False):
                 )
 
                 if not self.env.cr.fetchone():
-                    raise UserError(_("This record was modified by another user. " "Please refresh and try again."))
+                    raise UserError(_("This record was modified by another user. Please refresh and try again."))
         else:
             # ORM approach for computed/non-stored approval_state
             # Verify the record is in pending state (via computed field)
@@ -416,7 +419,7 @@ def _do_approve(self, comment=None, auto=False):
                 )
 
                 if not self.env.cr.fetchone():
-                    raise UserError(_("This record was modified by another user. " "Please refresh and try again."))
+                    raise UserError(_("This record was modified by another user. Please refresh and try again."))
 
         # Invalidate cache
         self.invalidate_recordset()

spp_dci_client/services/client.py

@@ -1,5 +1,6 @@
 """DCI Client Service for making signed API requests."""
 
+import json
 import logging
 import time
 import uuid
@@ -943,7 +944,7 @@ def _make_request(self, endpoint: str, envelope: dict, _retry_auth: bool = True)
                     log_error_detail = "401 Unauthorized - retrying with fresh token"
                     try:
                         log_response_data = response.json()
-                    except Exception:
+                    except json.JSONDecodeError:
                         log_response_data = None
                     self.data_source.clear_oauth2_token_cache()
                     return self._make_request(endpoint, envelope, _retry_auth=False)
@@ -979,7 +980,7 @@ def _make_request(self, endpoint: str, envelope: dict, _retry_auth: bool = True)
                     technical_detail += f": {error_data['header']['status_reason_message']}"
                 else:
                     technical_detail += f": {response_text}"
-            except Exception:
+            except (json.JSONDecodeError, KeyError, TypeError):
                 technical_detail += f": {response_text}"
 
             log_error_detail = technical_detail