[18.0][ADD] base_user_role_export

base_user_role_export/README.rst

@@ -0,0 +1,136 @@
+=====================
+Base User Role Export
+=====================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:2c495e8ebb65363964917c0340e1297f635bffb5bd59d65360c66f9f702ac249
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
+    :alt: License: AGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--backend-lightgray.png?logo=github
+    :target: https://github.com/OCA/server-backend/tree/18.0/base_user_role_export
+    :alt: OCA/server-backend
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/server-backend-18-0/server-backend-18-0-base_user_role_export
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-backend&target_branch=18.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module bridges **Base User Role** (``base_user_role``) and **Base
+Export Manager** (``base_export_manager``) to enforce role-based export
+access control.
+
+When users are governed by roles, export permissions are determined
+exclusively by the ``perm_export`` flag on ``ir.model.access`` records
+that belong to the user's active role groups. Any model not covered by
+such a record will be hidden from export, regardless of other group
+memberships.
+
+Additionally, the export action (``export_xlsx`` button) in list and
+kanban views is dynamically disabled for models where the active role
+does not explicitly grant export access.
+
+   **Important:** The Odoo group **"Access to export feature"**
+   (``base.group_allow_export``) **must be added to a role's implied
+   groups** for the export feature to be available to users assigned
+   that role. This group is pre-populated automatically when creating a
+   new role, but can be removed when export access is explicitly
+   unwanted.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Installation
+============
+
+To install this module, you need to:
+
+1. Ensure the dependencies ``base_user_role_extended`` and
+   ``base_export_manager`` are available in your addons path.
+2. Install this module ``base_user_role_export``.
+
+Usage
+=====
+
+To use this module:
+
+1. Install this module (depends on ``base_user_role``,
+   ``base_user_role_extended``, and ``base_export_manager``).
+2. Go to **Settings › Users & Companies › Roles**.
+3. Create or open a role.
+4. **Verify that the group "Access to export feature" is present in the
+   role's implied groups.** This group is added automatically when
+   creating a new role; remove it only when export should be explicitly
+   denied.
+5. On the **Model Access** tab, set ``perm_export = True`` on each model
+   line that role should be allowed to export.
+6. Assign the role to the relevant users and enable it.
+
+Users governed by an active role will only be able to export models for
+which their role's model access record has ``perm_export`` checked
+**and** the "Access to export feature" group is implied by their role.
+
+Changelog
+=========
+
+18.0.1.0.0
+----------
+
+- Initial release. Includes dynamic restriction of the ``export_xlsx``
+  action in list and kanban views based on user role permissions.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-backend/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/server-backend/issues/new?body=module:%20base_user_role_export%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* CIT Services
+
+Contributors
+------------
+
+- `CIT-Services <cit-services.eu>`__
+
+  - Solomon Prabu s.prabu@cit-services.eu
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+This module is part of the `OCA/server-backend <https://github.com/OCA/server-backend/tree/18.0/base_user_role_export>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

base_user_role_export/__init__.py

@@ -0,0 +1,3 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+from . import models

base_user_role_export/__manifest__.py

@@ -0,0 +1,15 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+
+{
+    "name": "Base User Role Export",
+    "version": "18.0.1.0.0",
+    "category": "Tools",
+    "summary": "Restrict export access via role-based groups using base_export_manager",
+    "author": "CIT Services, Odoo Community Association (OCA)",
+    "website": "https://github.com/OCA/server-backend",
+    "license": "AGPL-3",
+    "depends": ["base_user_role_extended", "base_export_manager"],
+    "data": [],
+    "installable": True,
+}

base_user_role_export/models/__init__.py

@@ -0,0 +1,5 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+from . import ir_ui_view
+from . import res_users
+from . import res_users_role

base_user_role_export/models/ir_ui_view.py

@@ -0,0 +1,38 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+
+from odoo import models
+
+
+class IrUiView(models.Model):
+    _inherit = "ir.ui.view"
+
+    def _postprocess_access_rights(self, tree):
+        """Disable the 'export all' action based on the user's
+        effective model access rights."""
+        target_model = tree.get("model_access_rights")
+        tree = super()._postprocess_access_rights(tree)
+
+        if not target_model or tree.tag not in ("list", "kanban"):
+            return tree
+
+        group_ids = tuple(self.env.user.with_context(role=True)._get_group_ids())
+        has_export = bool(
+            self.env["ir.model.access"]
+            .sudo()
+            .search(
+                [
+                    ("model_id.model", "=", target_model),
+                    ("perm_export", "=", True),
+                    "|",
+                    ("group_id", "=", False),
+                    ("group_id", "in", group_ids),
+                ],
+                limit=1,
+            )
+        )
+
+        if not has_export:
+            tree.set("export_xlsx", "0")
+
+        return tree

base_user_role_export/models/res_users.py

@@ -0,0 +1,38 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+
+from odoo import api, models
+
+
+class ResUsers(models.Model):
+    _inherit = "res.users"
+
+    @api.model
+    def fetch_export_models(self):
+        """Return the list of models the current user is allowed to export.
+
+        Enforces exclusive role-based access: only models whose
+        ``ir.model.access`` record has ``perm_export = True`` for one of the
+        current user's active role groups are returned.
+
+        Falls back to the standard implementation when:
+        - the parent method does not exist (``base_export_manager`` not
+          installed),
+        - the user has the ``bypass_role_policy`` flag set, or
+        - the user has no enabled roles.
+        """
+        if self.env.user.bypass_role_policy or not self.env.user._get_enabled_roles():
+            return super().fetch_export_models()
+
+        role_group_ids = tuple(self.env.user.with_context(role=True)._get_group_ids())
+        accessobj = self.env["ir.model.access"].sudo()
+
+        accessobj_ids = accessobj.search(
+            [
+                ("perm_export", "=", True),
+                "|",
+                ("group_id", "=", False),
+                ("group_id", "in", role_group_ids),
+            ]
+        )
+        return list(set(accessobj_ids.mapped("model_id.model")))

base_user_role_export/models/res_users_role.py

@@ -0,0 +1,14 @@
+# Copyright 2026 CIT Services
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
+
+from odoo import models
+
+
+class ResUsersRole(models.Model):
+    _inherit = "res.users.role"
+
+    def collect_all_perm_fields(self, perm_fields=None):
+        """Include `perm_export` in the synchronized permission fields."""
+        res = super().collect_all_perm_fields(perm_fields)
+        res.setdefault("perm_export", False)
+        return res

base_user_role_export/pyproject.toml

@@ -0,0 +1,3 @@
+[build-system]
+requires = ["whool"]
+build-backend = "whool.buildapi"

base_user_role_export/readme/CONTRIBUTORS.md

@@ -0,0 +1,2 @@
+- [CIT-Services](cit-services.eu)
+  - Solomon Prabu <s.prabu@cit-services.eu>

base_user_role_export/readme/DESCRIPTION.md

@@ -0,0 +1,18 @@
+This module bridges **Base User Role** (`base_user_role`) and
+**Base Export Manager** (`base_export_manager`) to enforce role-based export
+access control.
+
+When users are governed by roles, export permissions are determined
+exclusively by the ``perm_export`` flag on ``ir.model.access`` records that
+belong to the user's active role groups.  Any model not covered by such a
+record will be hidden from export, regardless of other group memberships.
+
+Additionally, the export action (`export_xlsx` button) in list and kanban views
+is dynamically disabled for models where the active role does not explicitly
+grant export access.
+
+> **Important:** The Odoo group **"Access to export feature"**
+> (``base.group_allow_export``) **must be added to a role's implied groups**
+> for the export feature to be available to users assigned that role.
+> This group is pre-populated automatically when creating a new role, but
+> can be removed when export access is explicitly unwanted.

base_user_role_export/readme/HISTORY.md

@@ -0,0 +1,4 @@
+18.0.1.0.0
+----------
+
+* Initial release. Includes dynamic restriction of the `export_xlsx` action in list and kanban views based on user role permissions.

base_user_role_export/readme/INSTALL.md

@@ -0,0 +1,4 @@
+To install this module, you need to:
+
+1. Ensure the dependencies `base_user_role_extended` and `base_export_manager` are available in your addons path.
+2. Install this module `base_user_role_export`.

base_user_role_export/readme/USAGE.md

@@ -0,0 +1,16 @@
+To use this module:
+
+1. Install this module (depends on `base_user_role`, `base_user_role_extended`,
+   and `base_export_manager`).
+2. Go to **Settings › Users & Companies › Roles**.
+3. Create or open a role.
+4. **Verify that the group "Access to export feature" is present in the
+   role's implied groups.** This group is added automatically when creating
+   a new role; remove it only when export should be explicitly denied.
+5. On the **Model Access** tab, set `perm_export = True` on each model line
+   that role should be allowed to export.
+6. Assign the role to the relevant users and enable it.
+
+Users governed by an active role will only be able to export models for which
+their role's model access record has `perm_export` checked **and** the
+"Access to export feature" group is implied by their role.