fix(roles): complete OP#951 menu audit — role group updates + menu gating

spp_area/__manifest__.py

@@ -6,7 +6,7 @@
     "name": "OpenSPP Area Management",
     "summary": "Establishes direct associations between OpenSPP registrants, beneficiary groups, and their corresponding geographical administrative areas. It validates registrant-area linkages against official area types, ensuring data integrity and enabling targeted program delivery and analysis.",
     "category": "OpenSPP/Core",
-    "version": "19.0.2.0.0",
+    "version": "19.0.2.0.1",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",
@@ -30,6 +30,7 @@
         "data/area_type_data.xml",
         "data/area_tag_data.xml",
         "data/queue_limit_data.xml",
+        "data/user_roles.xml",
         "security/privileges.xml",
         "security/groups.xml",
         "security/ir.model.access.csv",

spp_area/data/user_roles.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+
+Role extensions: grant `group_area_viewer` (read-only) to spp_user_roles support
+roles whose audited menu visibility should include "Area" (OP#951).
+
+System Admin sees the menu via `spp_security.group_spp_admin` → `group_area_manager`.
+-->
+<odoo noupdate="1">
+    <record id="spp_user_roles.global_role_support" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_area_viewer'))]" />
+    </record>
+    <record id="spp_user_roles.global_role_support_manager" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_area_viewer'))]" />
+    </record>
+    <record id="spp_user_roles.local_role_support" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_area_viewer'))]" />
+    </record>
+</odoo>

spp_area/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.0.1
+
+- fix(security): grant `group_area_viewer` (read-only) to spp_user_roles support roles (Global Support, Global Support Manager, Local Support) so they can browse area records per the OP#951 menu audit.
+
 ### 19.0.2.0.0
 
 - Initial migration to OpenSPP2

spp_change_request_v2/__manifest__.py

@@ -1,6 +1,6 @@
 {
     "name": "OpenSPP Change Request V2",
-    "version": "19.0.2.0.3",
+    "version": "19.0.2.0.4",
     "sequence": 50,
     "category": "OpenSPP",
     "summary": "Configuration-driven change request system with UX improvements, conflict detection and duplicate prevention",
@@ -16,6 +16,7 @@
         "spp_security",
         "spp_approval",
         "spp_event_data",
+        "spp_hazard",
         "spp_dms",
         "spp_vocabulary",
     ],

spp_change_request_v2/data/user_roles.xml

@@ -18,7 +18,8 @@ User roles for Change Request module.
             eval="[
                 Command.link(ref('base.group_user')),
                 Command.link(ref('group_cr_manager')),
-                Command.link(ref('spp_registry.group_registry_read')),
+                Command.link(ref('spp_registry.group_registry_viewer')),
+                Command.link(ref('spp_hazard.group_hazard_viewer')),
             ]"
         />
     </record>
@@ -34,7 +35,8 @@ User roles for Change Request module.
             eval="[
                 Command.link(ref('base.group_user')),
                 Command.link(ref('group_cr_validator')),
-                Command.link(ref('spp_registry.group_registry_read')),
+                Command.link(ref('spp_registry.group_registry_viewer')),
+                Command.link(ref('spp_hazard.group_hazard_viewer')),
             ]"
         />
     </record>
@@ -50,7 +52,8 @@ User roles for Change Request module.
             eval="[
                 Command.link(ref('base.group_user')),
                 Command.link(ref('group_cr_validator_hq')),
-                Command.link(ref('spp_registry.group_registry_read')),
+                Command.link(ref('spp_registry.group_registry_viewer')),
+                Command.link(ref('spp_hazard.group_hazard_viewer')),
             ]"
         />
     </record>

spp_change_request_v2/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.0.4
+
+- fix(security): align CR Requestor / CR Local Validator / CR HQ Validator roles with the OP#951 menu audit — replace the `spp_registry.group_registry_read` (Tier-3, no menu) link with `spp_registry.group_registry_viewer` so these roles see the Registry menu; add `spp_hazard.group_hazard_viewer` so they retain Hazard visibility once the menu root is gated. Adds `spp_hazard` to module dependencies.
+
 ### 19.0.2.0.3
 
 - fix: add HTML escaping to all computed Html fields with `sanitize=False` to prevent stored XSS (#50)

spp_farmer_registry/__manifest__.py

@@ -3,7 +3,7 @@
     "name": "OpenSPP Farmer Registry",
     "summary": "Farmer Registry with vocabulary-based fields, CEL variables, and Logic Studio integration",
     "category": "OpenSPP",
-    "version": "19.0.2.0.0",
+    "version": "19.0.2.0.1",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",
@@ -26,6 +26,9 @@
         "spp_land_record",
         "spp_irrigation",
         "spp_gis",
+        # OP#951 menu audit — roles get hazard / GIS reports menu access
+        "spp_hazard",
+        "spp_gis_report",
     ],
     "excludes": [
         "spp_base_farmer_registry",  # V1 module - incompatible _inherits definitions

spp_farmer_registry/data/user_roles.xml

@@ -17,6 +17,8 @@
                 Command.link(ref('base.group_user')),
                 Command.link(ref('group_spp_farm_user')),
                 Command.link(ref('spp_registry.group_registry_officer')),
+                Command.link(ref('spp_hazard.group_hazard_viewer')),
+                Command.link(ref('spp_gis_report.group_gis_report_user')),
             ]"
         />
     </record>
@@ -35,6 +37,8 @@
                 Command.link(ref('group_spp_farm_manager')),
                 Command.link(ref('spp_irrigation.group_irrigation_manager')),
                 Command.link(ref('spp_registry.group_registry_manager')),
+                Command.link(ref('spp_hazard.group_hazard_viewer')),
+                Command.link(ref('spp_gis_report.group_gis_report_user')),
             ]"
         />
     </record>

spp_farmer_registry/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.0.1
+
+- fix(security): align Farm User / Farm Manager roles with the OP#951 menu audit — both farm roles now imply `spp_hazard.group_hazard_viewer` and `spp_gis_report.group_gis_report_user` so they retain Hazard and GIS Reports menu visibility once those menu roots are gated. Adds `spp_hazard` and `spp_gis_report` to module dependencies.
+
 ### 19.0.2.0.0
 
 - Initial migration to OpenSPP2

spp_gis_report/__manifest__.py

@@ -1,6 +1,6 @@
 {
     "name": "OpenSPP GIS Reports",
-    "version": "19.0.2.0.0",
+    "version": "19.0.2.0.1",
     "category": "OpenSPP",
     "summary": "Geographic visualization and reporting for social protection data",
     "author": "OpenSPP.org, OpenSPP",
@@ -26,6 +26,7 @@
         "security/ir.model.access.csv",
         # Data
         "data/gis_report_category_data.xml",
+        "data/user_roles.xml",
         "data/templates/coverage_templates.xml",
         "data/templates/disaster_templates.xml",
         "data/templates/demographic_templates.xml",

spp_gis_report/data/user_roles.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+
+Role extensions: grant `group_gis_report_user` (read tier) to spp_user_roles
+roles whose audited menu visibility should include "GIS Reports" (OP#951).
+
+System Admin sees the menu via `spp_security.group_spp_admin` → `group_gis_report_manager`
+(wired in `spp_gis_report/security/groups.xml`).
+
+Roles defined in spp_programs / spp_farmer_registry have their gis_report_user
+extensions in those modules' own user_roles.xml.
+-->
+<odoo noupdate="1">
+    <record id="spp_user_roles.global_role_program_manager" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_gis_report_user'))]" />
+    </record>
+</odoo>

spp_gis_report/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.0.1
+
+- fix(security): grant `group_gis_report_user` to spp_user_roles' Global Program Manager role so the OP#951 menu audit expectation (Program Manager sees GIS Reports) is preserved once the GIS Reports menu root is gated.
+
 ### 19.0.2.0.0
 
 - Initial migration to OpenSPP2

spp_hazard/__manifest__.py

@@ -8,7 +8,7 @@
     "for emergency response. Links registrants to disaster events with geographic scope "
     "and severity tracking to enable targeted humanitarian assistance.",
     "category": "OpenSPP/Targeting",
-    "version": "19.0.2.0.0",
+    "version": "19.0.2.0.1",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",
@@ -27,6 +27,7 @@
         "security/groups.xml",
         "security/ir.model.access.csv",
         "data/impact_type_data.xml",
+        "data/user_roles.xml",
         "views/hazard_category_views.xml",
         "views/hazard_incident_views.xml",
         "views/hazard_impact_views.xml",

spp_hazard/data/user_roles.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+
+Role extensions: grant `group_hazard_viewer` to spp_user_roles roles whose
+audited menu visibility should include "Hazard and Emergency" (OP#951).
+
+Roles that should NOT see Hazard per the audit (Global Finance, Global Support,
+Global Support Manager, Local Support) are intentionally omitted.
+
+System Admin sees the menu via `spp_security.group_spp_admin` → `group_hazard_manager`
+(wired in `spp_hazard/security/groups.xml`), so no extension is needed for that role.
+
+Roles defined in spp_programs / spp_change_request_v2 / spp_farmer_registry have
+their hazard-viewer extensions in those modules' own user_roles.xml (this module
+does not depend on them).
+-->
+<odoo noupdate="1">
+    <record id="spp_user_roles.global_role_registry_viewer" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_hazard_viewer'))]" />
+    </record>
+    <record id="spp_user_roles.global_role_program_manager" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_hazard_viewer'))]" />
+    </record>
+    <record id="spp_user_roles.global_role_registrar" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_hazard_viewer'))]" />
+    </record>
+    <record id="spp_user_roles.local_role_registrar" model="res.users.role">
+        <field name="implied_ids" eval="[Command.link(ref('group_hazard_viewer'))]" />
+    </record>
+</odoo>

spp_hazard/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.0.1
+
+- fix(security): grant `group_hazard_viewer` to spp_user_roles roles (Registry Viewer, Program Manager, Global/Local Registrar) that the OP#951 menu audit identifies as needing read-only Hazard menu access. Other affected roles defined outside this module (program/CR/farm roles) are wired in their own modules.
+
 ### 19.0.2.0.0
 
 - Initial migration to OpenSPP2