fix(security): let Tier-3 registry read reach the registrant form's models

docker-compose.yml

@@ -59,7 +59,7 @@ services:
       POSTGRES_DB: openspp
     volumes:
       - postgres_data:/var/lib/postgresql
-      - ./docker/postgresql.conf:/etc/postgresql/postgresql.conf:ro
+      - ./docker/postgresql.conf:/etc/postgresql/postgresql.conf:ro,z
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U odoo -d postgres"]
       interval: 5s

spp_consent/README.rst

@@ -193,6 +193,18 @@ Dependencies
 Changelog
 =========
 
+19.0.2.0.2
+~~~~~~~~~~
+
+- fix(security): the Tier-3 ``group_registry_read`` group can read the
+  consent models the registrant form depends on. This module extends
+  that form, and its models were granted only to the Tier-2
+  ``group_registry_viewer`` group, so a Tier-3-scoped role hit an
+  AccessError opening a registrant. The two wizard models are
+  deliberately not included: their entry points are restricted to the
+  officer and manager tiers, so read access would grant nothing usable
+  while exposing other users' in-progress wizard rows.
+
 19.0.2.0.1
 ~~~~~~~~~~
 

spp_consent/__manifest__.py

@@ -3,7 +3,7 @@
 {
     "name": "OpenSPP Consent",
     "category": "OpenSPP",
-    "version": "19.0.2.0.1",
+    "version": "19.0.2.0.2",
     "summary": """DPV-aligned consent management for social protection programs.
 
 Implements ISO/IEC TS 27560:2023 consent record information structure

spp_consent/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.0.2
+
+- fix(security): the Tier-3 `group_registry_read` group can read the consent models the registrant form depends on. This module extends that form, and its models were granted only to the Tier-2 `group_registry_viewer` group, so a Tier-3-scoped role hit an AccessError opening a registrant. The two wizard models are deliberately not included: their entry points are restricted to the officer and manager tiers, so read access would grant nothing usable while exposing other users' in-progress wizard rows.
+
 ### 19.0.2.0.1
 
 - fix(views): apply `spp_registry.x2many_no_padding` widget to the Consents list on registrant forms, and hide the table entirely when there are no consents (showing a muted info line instead) — matches the empty-state treatment of read-only / no-create lists elsewhere (#943).

spp_consent/security/ir.model.access.csv

@@ -35,3 +35,10 @@ access_spp_bulk_record_consent_wizard_viewer,Bulk Record Consent Wizard Viewer A
 access_spp_bulk_record_consent_wizard_officer,Bulk Record Consent Wizard Officer Access,spp_consent.model_spp_bulk_record_consent_wizard,spp_registry.group_registry_officer,1,1,1,0
 access_spp_bulk_record_consent_wizard_manager,Bulk Record Consent Wizard Manager Access,spp_consent.model_spp_bulk_record_consent_wizard,spp_registry.group_registry_manager,1,1,1,1
 access_spp_bulk_record_consent_wizard_admin,Bulk Record Consent Wizard Admin Access,spp_consent.model_spp_bulk_record_consent_wizard,spp_security.group_spp_admin,1,1,1,1
+access_spp_consent_registry_read,Consent Registry Read Access,spp_consent.model_spp_consent,spp_registry.group_registry_read,1,0,0,0
+access_spp_consent_purpose_registry_read,Consent Purpose Registry Read Access,spp_consent.model_spp_consent_purpose,spp_registry.group_registry_read,1,0,0,0
+access_spp_consent_personal_data_registry_read,Consent Personal Data Registry Read Access,spp_consent.model_spp_consent_personal_data,spp_registry.group_registry_read,1,0,0,0
+access_spp_consent_processing_registry_read,Consent Processing Registry Read Access,spp_consent.model_spp_consent_processing,spp_registry.group_registry_read,1,0,0,0
+access_spp_consent_notice_registry_read,Consent Notice Registry Read Access,spp_consent.model_spp_consent_notice,spp_registry.group_registry_read,1,0,0,0
+access_spp_consent_history_registry_read,Consent History Registry Read Access,spp_consent.model_spp_consent_history,spp_registry.group_registry_read,1,0,0,0
+access_spp_consent_org_type_registry_read,Consent Org Type Registry Read Access,spp_consent.model_spp_consent_org_type,spp_registry.group_registry_read,1,0,0,0

spp_consent/static/description/index.html

@@ -589,6 +589,19 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
 </div>
 </div>
 <div class="section" id="section-1">
+<h1>19.0.2.0.2</h1>
+<ul class="simple">
+<li>fix(security): the Tier-3 <tt class="docutils literal">group_registry_read</tt> group can read the
+consent models the registrant form depends on. This module extends
+that form, and its models were granted only to the Tier-2
+<tt class="docutils literal">group_registry_viewer</tt> group, so a Tier-3-scoped role hit an
+AccessError opening a registrant. The two wizard models are
+deliberately not included: their entry points are restricted to the
+officer and manager tiers, so read access would grant nothing usable
+while exposing other users’ in-progress wizard rows.</li>
+</ul>
+</div>
+<div class="section" id="section-2">
 <h1>19.0.2.0.1</h1>
 <ul class="simple">
 <li>fix(views): apply <tt class="docutils literal">spp_registry.x2many_no_padding</tt> widget to the
@@ -598,7 +611,7 @@ <h1>19.0.2.0.1</h1>
 (#943).</li>
 </ul>
 </div>
-<div class="section" id="section-2">
+<div class="section" id="section-3">
 <h1>19.0.2.0.0</h1>
 <ul class="simple">
 <li>Initial migration to OpenSPP2</li>

spp_consent/tests/__init__.py

@@ -10,4 +10,5 @@
 from . import test_privacy_notices
 from . import test_record_consent_wizard
 from . import test_registrant
+from . import test_registry_read_access
 from . import test_security

spp_consent/tests/test_registry_read_access.py

@@ -0,0 +1,44 @@
+# Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+"""Tier-3 ``group_registry_read`` must cover this module's registrant-form models.
+
+``spp_registry.group_registry_viewer`` (Tier-2) implies ``group_registry_read``
+(Tier-3), so any ACL granted only to the viewer tier disappears for a role
+scoped to the read tier. ``spp_consent/views/registrant_view.xml`` extends the registrant form,
+so a read-tier role that opens a registrant hits an AccessError unless the
+Tier-3 group carries these models too.
+"""
+
+from odoo import Command
+from odoo.tests import TransactionCase, tagged
+
+_MODELS = [
+    "spp.consent",
+    "spp.consent.purpose",
+    "spp.consent.personal.data",
+    "spp.consent.processing",
+    "spp.consent.notice",
+    "spp.consent.history",
+    "spp.consent.org.type",
+]
+
+
+@tagged("post_install", "-at_install")
+class TestRegistryReadAccess(TransactionCase):
+    def test_tier3_registry_read_covers_registrant_form_models(self):
+        user = self.env["res.users"].create(
+            {
+                "name": "Tier3 Reader",
+                "login": "tier3_reader_spp_consent",
+                "email": "tier3_reader_spp_consent@example.com",
+                "group_ids": [
+                    Command.link(self.env.ref("base.group_user").id),
+                    Command.link(self.env.ref("spp_registry.group_registry_read").id),
+                ],
+            }
+        )
+        Access = self.env["ir.model.access"].with_user(user)
+        missing = sorted(m for m in _MODELS if not Access.check(m, "read", raise_exception=False))
+        self.assertFalse(
+            missing,
+            "Tier-3 group_registry_read cannot read registrant-form models: " + ", ".join(missing),
+        )

spp_irrigation/README.rst

@@ -100,6 +100,14 @@ Dependencies
 Changelog
 =========
 
+19.0.2.1.1
+~~~~~~~~~~
+
+- fix(security): the Tier-3 ``group_registry_read`` group can read
+  ``spp.irrigation.asset``. The registrant form renders
+  ``irrigation_asset_ids``, and the model was granted only to the Tier-2
+  ``group_registry_viewer`` group.
+
 19.0.2.1.0
 ~~~~~~~~~~
 

spp_irrigation/__manifest__.py

@@ -5,7 +5,7 @@
 {
     "name": "OpenSPP Irrigation",
     "category": "OpenSPP",
-    "version": "19.0.2.1.0",
+    "version": "19.0.2.1.1",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",

spp_irrigation/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.1.1
+
+- fix(security): the Tier-3 `group_registry_read` group can read `spp.irrigation.asset`. The registrant form renders `irrigation_asset_ids`, and the model was granted only to the Tier-2 `group_registry_viewer` group.
+
 ### 19.0.2.1.0
 
 - feat(views): add an "Irrigation" tab on the farm (group) form so per-farm irrigation assets are reachable without leaving the farm record; backed by a new `irrigation_asset_ids` One2many on `res.partner` (inverse of the existing `farm_id`)

spp_irrigation/security/ir.model.access.csv

@@ -1,4 +1,5 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 
 access_spp_irrigation_asset,SPP Irrigation Asset Access,model_spp_irrigation_asset,spp_irrigation.group_irrigation_manager,1,1,1,1
-access_spp_irrigation_asset_registry_read,SPP Irrigation Asset Read,model_spp_irrigation_asset,spp_registry.group_registry_viewer,1,0,0,0
+access_spp_irrigation_asset_registry_viewer,SPP Irrigation Asset Viewer Read,model_spp_irrigation_asset,spp_registry.group_registry_viewer,1,0,0,0
+access_spp_irrigation_asset_registry_read,SPP Irrigation Asset Registry Read,model_spp_irrigation_asset,spp_registry.group_registry_read,1,0,0,0

spp_irrigation/static/description/index.html

@@ -468,6 +468,15 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
 </div>
 </div>
 <div class="section" id="section-1">
+<h1>19.0.2.1.1</h1>
+<ul class="simple">
+<li>fix(security): the Tier-3 <tt class="docutils literal">group_registry_read</tt> group can read
+<tt class="docutils literal">spp.irrigation.asset</tt>. The registrant form renders
+<tt class="docutils literal">irrigation_asset_ids</tt>, and the model was granted only to the Tier-2
+<tt class="docutils literal">group_registry_viewer</tt> group.</li>
+</ul>
+</div>
+<div class="section" id="section-2">
 <h1>19.0.2.1.0</h1>
 <ul class="simple">
 <li>feat(views): add an “Irrigation” tab on the farm (group) form so
@@ -476,7 +485,7 @@ <h1>19.0.2.1.0</h1>
 <tt class="docutils literal">res.partner</tt> (inverse of the existing <tt class="docutils literal">farm_id</tt>)</li>
 </ul>
 </div>
-<div class="section" id="section-2">
+<div class="section" id="section-3">
 <h1>19.0.2.0.0</h1>
 <ul class="simple">
 <li>Initial migration to OpenSPP2</li>

spp_irrigation/tests/__init__.py

@@ -1,3 +1,4 @@
 # Part of OpenSPP. See LICENSE file for full copyright and licensing details.
 from . import test_irrigation_asset
 from . import test_irrigation_edge_cases
+from . import test_registry_read_access

spp_irrigation/tests/test_registry_read_access.py

@@ -0,0 +1,39 @@
+# Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+"""Tier-3 ``group_registry_read`` must cover this module's registrant-form models.
+
+``spp_registry.group_registry_viewer`` (Tier-2) implies ``group_registry_read``
+(Tier-3), so any ACL granted only to the viewer tier disappears for a role
+scoped to the read tier. ``spp_irrigation/views/irrigation_view.xml`` renders
+``irrigation_asset_ids`` on the registrant form,
+so a read-tier role that opens a registrant hits an AccessError unless the
+Tier-3 group carries these models too.
+"""
+
+from odoo import Command
+from odoo.tests import TransactionCase, tagged
+
+_MODELS = [
+    "spp.irrigation.asset",
+]
+
+
+@tagged("post_install", "-at_install")
+class TestRegistryReadAccess(TransactionCase):
+    def test_tier3_registry_read_covers_registrant_form_models(self):
+        user = self.env["res.users"].create(
+            {
+                "name": "Tier3 Reader",
+                "login": "tier3_reader_spp_irrigation",
+                "email": "tier3_reader_spp_irrigation@example.com",
+                "group_ids": [
+                    Command.link(self.env.ref("base.group_user").id),
+                    Command.link(self.env.ref("spp_registry.group_registry_read").id),
+                ],
+            }
+        )
+        Access = self.env["ir.model.access"].with_user(user)
+        missing = sorted(m for m in _MODELS if not Access.check(m, "read", raise_exception=False))
+        self.assertFalse(
+            missing,
+            "Tier-3 group_registry_read cannot read registrant-form models: " + ", ".join(missing),
+        )

spp_programs/README.rst

@@ -254,6 +254,16 @@ Dependencies
 Changelog
 =========
 
+19.0.2.3.4
+~~~~~~~~~~
+
+- fix(security): the Tier-3 ``group_registry_read`` group can read
+  ``spp.cycle`` and ``spp.cycle.membership``. Both were granted only to
+  the Tier-2 ``group_registry_viewer`` group, yet the registrant form
+  depends on both: the entitlement lists render ``cycle_id``, and the
+  membership list renders ``latest_cycle_state``, which is computed by
+  searching ``spp.cycle.membership`` as the acting user.
+
 19.0.2.3.3
 ~~~~~~~~~~
 

spp_programs/__manifest__.py

@@ -4,7 +4,7 @@
     "name": "OpenSPP Programs",
     "summary": "Manage programs, cycles, beneficiary enrollment, entitlements (cash and in-kind), payments, and fund tracking for social protection.",
     "category": "OpenSPP/Core",
-    "version": "19.0.2.3.3",
+    "version": "19.0.2.3.4",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",

spp_programs/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.3.4
+
+- fix(security): the Tier-3 `group_registry_read` group can read `spp.cycle` and `spp.cycle.membership`. Both were granted only to the Tier-2 `group_registry_viewer` group, yet the registrant form depends on both: the entitlement lists render `cycle_id`, and the membership list renders `latest_cycle_state`, which is computed by searching `spp.cycle.membership` as the acting user.
+
 ### 19.0.2.3.3
 
 - fix(security): the operation lock is now guarded on create as well as write. Restricting only writes to `is_locked` / `locked_reason` left creation unguarded, so a program officer could create a cycle or program already locked and bypass the check entirely — and then could not clear the lock again, since clearing it goes through the guarded write, leaving a self-inflicted lockout only a system administrator could undo. The check is shared by both paths; `sudo()` and system administrators are unaffected, so the async pipeline keeps managing the lock as before.

spp_programs/security/ir.model.access.csv

@@ -406,3 +406,5 @@ access_spp_program_membership_exit_wizard_manager,Program Membership Exit Wizard
 access_spp_program_membership_exit_wizard_admin,Program Membership Exit Wizard Admin Access,spp_programs.model_spp_program_membership_exit_wizard,spp_security.group_spp_admin,1,1,1,1
 access_spp_deduplication_setup_wizard_manager,Deduplication Setup Wizard Manager Access,spp_programs.model_spp_deduplication_setup_wizard,group_programs_manager,1,1,1,1
 access_spp_deduplication_setup_wizard_admin,Deduplication Setup Wizard Admin Access,spp_programs.model_spp_deduplication_setup_wizard,spp_security.group_spp_admin,1,1,1,1
+access_spp_cycle_registry_read,Cycle Registry Read,spp_programs.model_spp_cycle,spp_registry.group_registry_read,1,0,0,0
+access_spp_cycle_membership_registry_read,Cycle Membership Registry Read,spp_programs.model_spp_cycle_membership,spp_registry.group_registry_read,1,0,0,0