[18.0][ADD] base_user_role_archive

base_user_role_archive/README.rst

@@ -0,0 +1,106 @@
+======================
+Base User Role Archive
+======================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:575bd928aa37b05539c97798d758feb381e21c2df6b42319e541d1a7f288316c
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
+    :alt: License: AGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--backend-lightgray.png?logo=github
+    :target: https://github.com/OCA/server-backend/tree/18.0/base_user_role_archive
+    :alt: OCA/server-backend
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/server-backend-18-0/server-backend-18-0-base_user_role_archive
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-backend&target_branch=18.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module extends ``base_user_role_extended`` to add **archive** and
+**unarchive** access control to role-based model permissions.
+
+It adds two new boolean fields to ``ir.model.access``:
+
+- **Archive Access** (``perm_archive``): controls whether a user may
+  archive records of that model.
+- **Unarchive Access** (``perm_unarchive``): controls whether a user may
+  unarchive records of that model.
+
+When a role's model access record has these permissions unchecked, the
+Archive / Unarchive actions are automatically hidden in the UI (List and
+Form view action menus) and blocked at the server level whenever the
+user tries to write ``active = False/True`` on a record.
+
+The enforcement logic follows the same strict role-group pattern as
+``base_user_role_extended``: for users with active roles, only the
+role's associated group access records are evaluated.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Usage
+=====
+
+1. Install the module.
+2. Go to **Settings → Users & Companies → Roles** and open a role.
+3. In the **Model Access** tab, find the model you want to restrict.
+4. Uncheck **Archive Access** to prevent archiving, or **Unarchive
+   Access** to prevent unarchiving.
+5. Save the role. The Archive / Unarchive options will disappear from
+   the action menus for users with this role, and server-side
+   enforcement will block any direct write to the ``active`` field as
+   well.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-backend/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/server-backend/issues/new?body=module:%20base_user_role_archive%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* CIT Services
+
+Contributors
+------------
+
+- ``CIT Services <https://www.cit-services.eu>``\ \_
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+This module is part of the `OCA/server-backend <https://github.com/OCA/server-backend/tree/18.0/base_user_role_archive>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

base_user_role_archive/__init__.py

@@ -0,0 +1,4 @@
+# Copyright 2026 CIT-Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from . import models

base_user_role_archive/__manifest__.py

@@ -0,0 +1,14 @@
+# Copyright 2026 CIT-Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+{
+    "name": "Base User Role Archive",
+    "version": "18.0.1.0.0",
+    "category": "Tools",
+    "summary": "Extends user roles for archive access in model access",
+    "author": "CIT Services, Odoo Community Association (OCA)",
+    "website": "https://github.com/OCA/server-backend",
+    "license": "AGPL-3",
+    "depends": ["base_user_role_extended", "base_archive_manager"],
+    "installable": True,
+}

base_user_role_archive/models/__init__.py

@@ -0,0 +1,5 @@
+# Copyright 2026 CIT-Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from . import ir_model_access
+from . import res_users_role

base_user_role_archive/models/ir_model_access.py

@@ -0,0 +1,25 @@
+# Copyright 2026 CIT Services
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl).
+from odoo import api, models, tools
+
+
+class IrModelAccess(models.Model):
+    _inherit = "ir.model.access"
+
+    @api.model
+    @tools.ormcache("self.env.uid", "model_name")
+    def _check_archive_access_cached(self, model_name):
+        """
+        Override to enforce exclusive role-based model access.
+        """
+        self = self.with_context(role=True)
+        return super()._check_archive_access_cached(model_name)
+
+    @api.model
+    @tools.ormcache("self.env.uid", "model_name")
+    def _check_unarchive_access_cached(self, model_name):
+        """
+        Override to enforce exclusive role-based model access.
+        """
+        self = self.with_context(role=True)
+        return super()._check_unarchive_access_cached(model_name)

base_user_role_archive/models/res_users_role.py

@@ -0,0 +1,18 @@
+# Copyright 2026 CIT-Services
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from odoo import models
+
+
+class ResUsersRole(models.Model):
+    _inherit = "res.users.role"
+
+    def collect_all_perm_fields(self, perm_fields=None):
+        res = super().collect_all_perm_fields(perm_fields)
+        res.update(
+            {
+                "perm_archive": False,
+                "perm_unarchive": False,
+            }
+        )
+        return res

base_user_role_archive/pyproject.toml

@@ -0,0 +1,3 @@
+[build-system]
+requires = ["whool"]
+build-backend = "whool.buildapi"

base_user_role_archive/readme/CONTRIBUTORS.md

@@ -0,0 +1,2 @@
+- [CIT-Services](cit-services.eu)
+  - Solomon Prabu <s.prabu@cit-services.eu>

base_user_role_archive/readme/DESCRIPTION.md

@@ -0,0 +1,18 @@
+This module extends `base_user_role_extended` to add **archive** and
+**unarchive** access control to role-based model permissions.
+
+It adds two new boolean fields to `ir.model.access`:
+
+- **Archive Access** (`perm_archive`): controls whether a user may archive
+  records of that model.
+- **Unarchive Access** (`perm_unarchive`): controls whether a user may
+  unarchive records of that model.
+
+When a role's model access record has these permissions unchecked, the
+Archive / Unarchive actions are automatically hidden in the UI (List and
+Form view action menus) and blocked at the server level whenever the
+user tries to write `active = False/True` on a record.
+
+The enforcement logic follows the same strict role-group pattern as
+`base_user_role_extended`: for users with active roles, only the role's
+associated group access records are evaluated.

base_user_role_archive/readme/USAGE.md

@@ -0,0 +1,8 @@
+1. Install the module.
+2. Go to **Settings → Users & Companies → Roles** and open a role.
+3. In the **Model Access** tab, find the model you want to restrict.
+4. Uncheck **Archive Access** to prevent archiving, or **Unarchive Access**
+   to prevent unarchiving.
+5. Save the role. The Archive / Unarchive options will disappear from the
+   action menus for users with this role, and server-side enforcement will
+   block any direct write to the `active` field as well.