Merge pull request #294 from OpenSPP/fix/1124-registry-search-create-buttons

fix(registry_search): gate New Individual/Group buttons on registry create-permission roles (#1124)

Author: emjay0921

spp_registry_search/README.rst

@@ -124,6 +124,14 @@ Dependencies
 Changelog
 =========
 
+19.0.2.1.1
+~~~~~~~~~~
+
+- fix(security): gate the Registry Search "New Individual/Group" buttons
+  on the registry create-permission roles instead of generic
+  ``res.partner`` create access, so roles without registrant-create
+  rights (e.g. validators) can no longer initiate creation (#1124)
+
 19.0.2.0.0
 ~~~~~~~~~~
 

spp_registry_search/__manifest__.py

@@ -2,7 +2,7 @@
 {
     "name": "OpenSPP Registry Search Portal",
     "category": "OpenSPP/Registry",
-    "version": "19.0.2.1.0",
+    "version": "19.0.2.1.1",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",

spp_registry_search/models/registry_view_history.py

@@ -210,6 +210,33 @@ def check_registrant_edit_permission(self):
                 continue
         return False
 
+    @api.model
+    def check_registrant_create_permission(self):
+        """Check if current user can create registrants from the UI (OP#1124).
+
+        Generic ``res.partner`` create access is too broad — base Odoo grants it
+        to most internal users — so it lets unintended roles (e.g. validators)
+        initiate registrant creation from Registry Search. Only the same
+        privileged registry roles allowed to edit may create.
+
+        Returns:
+            bool: True if user can create registrants in the UI
+        """
+        create_groups = [
+            "base.group_system",
+            "spp_security.group_spp_admin",
+            "spp_registry.group_registry_manager",
+            "spp_registry.group_registry_officer",
+        ]
+        for group in create_groups:
+            try:
+                if self.env.user.has_group(group):
+                    return True
+            except ValueError:
+                # Group doesn't exist (module not installed)
+                continue
+        return False
+
     @api.model
     def check_registrant_archive_permission(self):
         """Check if current user can archive/unarchive registrants in the UI.

spp_registry_search/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.1.1
+
+- fix(security): gate the Registry Search "New Individual/Group" buttons on the registry create-permission roles instead of generic `res.partner` create access, so roles without registrant-create rights (e.g. validators) can no longer initiate creation (#1124)
+
 ### 19.0.2.0.0
 
 - Initial migration to OpenSPP2

spp_registry_search/static/description/index.html

@@ -497,6 +497,15 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
 </div>
 </div>
 <div class="section" id="section-1">
+<h1>19.0.2.1.1</h1>
+<ul class="simple">
+<li>fix(security): gate the Registry Search “New Individual/Group” buttons
+on the registry create-permission roles instead of generic
+<tt class="docutils literal">res.partner</tt> create access, so roles without registrant-create
+rights (e.g. validators) can no longer initiate creation (#1124)</li>
+</ul>
+</div>
+<div class="section" id="section-2">
 <h1>19.0.2.0.0</h1>
 <ul class="simple">
 <li>Initial migration to OpenSPP2</li>

spp_registry_search/static/src/js/registry_search_portal.js

@@ -60,10 +60,14 @@ export class RegistrySearchPortal extends Component {
         onWillStart(async () => {
             try {
                 const [canCreate, canEdit, recentlyViewed, config] = await Promise.all([
-                    this.orm.call("res.partner", "check_access_rights", [
-                        "create",
-                        false,
-                    ]),
+                    // OP#1124: gate on the registry create-permission groups, not
+                    // generic res.partner create access (which base Odoo grants
+                    // broadly, letting validators/viewers initiate creation).
+                    this.orm.call(
+                        "spp.registry.view.history",
+                        "check_registrant_create_permission",
+                        []
+                    ),
                     this.orm.call(
                         "spp.registry.view.history",
                         "check_registrant_edit_permission",

spp_registry_search/tests/__init__.py

@@ -1,3 +1,4 @@
 # Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+from . import test_registrant_create_permission
 from . import test_registry_view_history
 from . import test_registry_view_history_security

spp_registry_search/tests/test_registrant_create_permission.py

@@ -0,0 +1,39 @@
+# Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+"""OP#1124: Registry-search create buttons must be gated on the registry
+create-permission roles, not generic res.partner create access."""
+
+from odoo.tests import TransactionCase, tagged
+
+
+@tagged("post_install", "-at_install")
+class TestRegistrantCreatePermission(TransactionCase):
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        cls.ViewHistory = cls.env["spp.registry.view.history"]
+
+    def _make_user(self, login, group_xmlids):
+        groups = []
+        for xmlid in group_xmlids:
+            grp = self.env.ref(xmlid, raise_if_not_found=False)
+            if grp:
+                groups.append(grp.id)
+        return self.env["res.users"].create({"name": login, "login": login, "group_ids": [(6, 0, groups)]})
+
+    def test_registry_officer_can_create(self):
+        user = self._make_user("t_1124_officer", ["base.group_user", "spp_registry.group_registry_officer"])
+        self.assertTrue(self.ViewHistory.with_user(user).check_registrant_create_permission())
+
+    def test_registry_manager_can_create(self):
+        user = self._make_user("t_1124_manager", ["base.group_user", "spp_registry.group_registry_manager"])
+        self.assertTrue(self.ViewHistory.with_user(user).check_registrant_create_permission())
+
+    def test_partner_creator_without_registry_role_cannot_create(self):
+        """A user with generic res.partner create access but NO registry role —
+        like the validator in OP#1124 — must be denied. This is the crux: the
+        old check keyed off res.partner create (which such a user passes)."""
+        user = self._make_user("t_1124_partmgr", ["base.group_user", "base.group_partner_manager"])
+        # Sanity: the old, too-broad basis (res.partner create) WOULD allow this user.
+        self.assertTrue(self.env["res.partner"].with_user(user).check_access_rights("create", raise_exception=False))
+        # The new, correct gate denies it (not a registry create role).
+        self.assertFalse(self.ViewHistory.with_user(user).check_registrant_create_permission())