From 34e5b46025c0b35dcca05069e9ba4709891d9b00 Mon Sep 17 00:00:00 2001
From: gsinghpal <gur_preet.singh@outlook.com>
Date: Wed, 25 Feb 2026 11:52:06 -0500
Subject: [PATCH] fix: comprehensive permission overhaul for fusion_faxes and
 fusion_ringcentral

Users without fax/RC groups could not open Sale Orders, Invoices, or
Contacts because the One2many computed fields triggered AccessError
on fusion.fax. Now base.group_user gets read-only access so computed
fields work silently, while all UI elements (smart buttons, header
buttons, menus, partner fields, settings) are restricted to the
proper security groups. Both modules now use Odoo 19 privilege
pattern for the user settings dropdown.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 fusion_faxes/security/ir.model.access.csv     |  2 +
 fusion_faxes/security/security.xml            | 55 ++++++++++++++-----
 fusion_faxes/views/account_move_views.xml     |  7 ++-
 fusion_faxes/views/fusion_fax_views.xml       |  3 +-
 fusion_faxes/views/res_partner_views.xml      | 15 +++--
 fusion_faxes/views/sale_order_views.xml       |  7 ++-
 .../security/ir.model.access.csv              |  2 +
 fusion_ringcentral/security/security.xml      | 27 +++++++++
 fusion_ringcentral/views/fusion_fax_views.xml | 19 ++++---
 .../views/res_config_settings_views.xml       |  3 +-
 .../views/res_partner_views.xml               | 10 ++--
 11 files changed, 112 insertions(+), 38 deletions(-)

diff --git a/fusion_faxes/security/ir.model.access.csv b/fusion_faxes/security/ir.model.access.csv
index f60eae9..d3a7fea 100644
--- a/fusion_faxes/security/ir.model.access.csv
+++ b/fusion_faxes/security/ir.model.access.csv
@@ -1,8 +1,10 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_fusion_fax_base,fusion.fax.base.read,model_fusion_fax,base.group_user,1,0,0,0
 access_fusion_fax_user,fusion.fax.user,model_fusion_fax,group_fax_user,1,1,1,0
 access_fusion_fax_manager,fusion.fax.manager,model_fusion_fax,group_fax_manager,1,1,1,1
 access_fusion_send_fax_wizard_user,fusion.send.fax.wizard.user,model_fusion_faxes_send_fax_wizard,group_fax_user,1,1,1,1
 access_fusion_send_fax_wizard_line_user,fusion.send.fax.wizard.line.user,model_fusion_faxes_send_fax_wizard_line,group_fax_user,1,1,1,1
+access_fusion_fax_document_base,fusion.fax.document.base.read,model_fusion_fax_document,base.group_user,1,0,0,0
 access_fusion_fax_document_user,fusion.fax.document.user,model_fusion_fax_document,group_fax_user,1,1,1,0
 access_fusion_fax_document_manager,fusion.fax.document.manager,model_fusion_fax_document,group_fax_manager,1,1,1,1
 access_fusion_fax_dashboard_user,fusion.fax.dashboard.user,model_fusion_fax_dashboard,group_fax_user,1,1,1,1
diff --git a/fusion_faxes/security/security.xml b/fusion_faxes/security/security.xml
index c457232..7fbe1a8 100644
--- a/fusion_faxes/security/security.xml
+++ b/fusion_faxes/security/security.xml
@@ -1,22 +1,51 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
+
+    <!-- Module category (appears in Settings > Users) -->
+    <record id="module_category_fusion_faxes" model="ir.module.category">
+        <field name="name">Fusion Faxes</field>
+        <field name="sequence">47</field>
+    </record>
+
+    <!-- Privilege (Odoo 19 user settings dropdown) -->
+    <record id="res_groups_privilege_fusion_faxes" model="res.groups.privilege">
+        <field name="name">Fusion Faxes</field>
+        <field name="sequence">47</field>
+        <field name="category_id" ref="module_category_fusion_faxes"/>
+    </record>
+
+    <!-- User group: can send faxes and view own fax history -->
+    <record id="group_fax_user" model="res.groups">
+        <field name="name">User</field>
+        <field name="sequence">10</field>
+        <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
+        <field name="privilege_id" ref="res_groups_privilege_fusion_faxes"/>
+    </record>
+
+    <!-- Manager group: can view all faxes and configure settings -->
+    <record id="group_fax_manager" model="res.groups">
+        <field name="name">Manager</field>
+        <field name="sequence">20</field>
+        <field name="implied_ids" eval="[(4, ref('group_fax_user'))]"/>
+        <field name="privilege_id" ref="res_groups_privilege_fusion_faxes"/>
+        <field name="user_ids" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
+    </record>
+
     <data noupdate="0">
 
-        <!-- User group: can send faxes and view own fax history -->
-        <record id="group_fax_user" model="res.groups">
-            <field name="name">Fusion Faxes / User</field>
-            <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
+        <!-- Base users can read fax records (needed for One2many computed fields on sale.order etc.) -->
+        <record id="rule_fax_base_read" model="ir.rule">
+            <field name="name">Fax: all internal users read-only</field>
+            <field name="model_id" ref="model_fusion_fax"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
         </record>
 
-        <!-- Manager group: can view all faxes and configure settings -->
-        <record id="group_fax_manager" model="res.groups">
-            <field name="name">Fusion Faxes / Manager</field>
-            <field name="implied_ids" eval="[(4, ref('group_fax_user'))]"/>
-        </record>
-
-        <!-- Record rules -->
-
-        <!-- Users see only their own faxes -->
+        <!-- Fax users see only their own faxes (full CRUD minus unlink) -->
         <record id="rule_fax_user_own" model="ir.rule">
             <field name="name">Fax: user sees own faxes</field>
             <field name="model_id" ref="model_fusion_fax"/>
diff --git a/fusion_faxes/views/account_move_views.xml b/fusion_faxes/views/account_move_views.xml
index 85ce70d..950c26a 100644
--- a/fusion_faxes/views/account_move_views.xml
+++ b/fusion_faxes/views/account_move_views.xml
@@ -8,16 +8,17 @@
         <field name="inherit_id" ref="account.view_move_form"/>
         <field name="arch" type="xml">
 
-            <!-- Smart button for fax count -->
+            <!-- Smart button for fax count (fax users only) -->
             <xpath expr="//div[@name='button_box']" position="inside">
                 <button name="action_view_faxes" type="object"
                         class="oe_stat_button" icon="fa-fax"
-                        invisible="x_ff_fax_count == 0">
+                        invisible="x_ff_fax_count == 0"
+                        groups="fusion_faxes.group_fax_user">
                     <field name="x_ff_fax_count" widget="statinfo" string="Faxes"/>
                 </button>
             </xpath>
 
-            <!-- Send Fax header button -->
+            <!-- Send Fax header button (fax users only) -->
             <xpath expr="//header" position="inside">
                 <button name="action_send_fax" string="Send Fax"
                         type="object" class="btn-secondary"
diff --git a/fusion_faxes/views/fusion_fax_views.xml b/fusion_faxes/views/fusion_fax_views.xml
index e3ec033..7d99fca 100644
--- a/fusion_faxes/views/fusion_fax_views.xml
+++ b/fusion_faxes/views/fusion_fax_views.xml
@@ -232,10 +232,11 @@
         <field name="search_view_id" ref="view_fusion_fax_search"/>
     </record>
 
-    <!-- Top-level Faxes menu -->
+    <!-- Top-level Faxes menu (fax users only) -->
     <menuitem id="menu_fusion_faxes_root"
               name="Faxes"
               web_icon="fusion_faxes,static/description/icon.png"
+              groups="group_fax_user"
               sequence="45"/>
 
     <menuitem id="menu_fusion_fax_list"
diff --git a/fusion_faxes/views/res_partner_views.xml b/fusion_faxes/views/res_partner_views.xml
index 2ac6244..798f2e3 100644
--- a/fusion_faxes/views/res_partner_views.xml
+++ b/fusion_faxes/views/res_partner_views.xml
@@ -8,28 +8,31 @@
         <field name="inherit_id" ref="base.view_partner_form"/>
         <field name="arch" type="xml">
 
-            <!-- Add fax number on its own row below phone -->
+            <!-- Add fax number on its own row below phone (fax users only) -->
             <xpath expr="//field[@name='phone']/.." position="after">
-                <div class="d-flex align-items-baseline w-md-50">
+                <div class="d-flex align-items-baseline w-md-50"
+                     groups="fusion_faxes.group_fax_user">
                     <i class="fa fa-fw me-1 fa-fax text-primary" title="Fax"/>
                     <field name="x_ff_fax_number" class="w-100" widget="phone"
                            placeholder="Fax number..."/>
                 </div>
             </xpath>
 
-            <!-- Add smart button for fax count -->
+            <!-- Add smart button for fax count (fax users only) -->
             <xpath expr="//div[@name='button_box']" position="inside">
                 <button name="action_view_faxes" type="object"
                         class="oe_stat_button" icon="fa-fax"
-                        invisible="x_ff_fax_count == 0">
+                        invisible="x_ff_fax_count == 0"
+                        groups="fusion_faxes.group_fax_user">
                     <field name="x_ff_fax_count" widget="statinfo" string="Faxes"/>
                 </button>
             </xpath>
 
-            <!-- Add Fax History tab -->
+            <!-- Add Fax History tab (fax users only) -->
             <xpath expr="//page[@name='internal_notes']" position="after">
                 <page string="Fax History" name="fax_history"
-                      invisible="x_ff_fax_count == 0">
+                      invisible="x_ff_fax_count == 0"
+                      groups="fusion_faxes.group_fax_user">
                     <field name="x_ff_fax_ids" readonly="1">
                         <list>
                             <field name="name"/>
diff --git a/fusion_faxes/views/sale_order_views.xml b/fusion_faxes/views/sale_order_views.xml
index 8a39ccb..7047c02 100644
--- a/fusion_faxes/views/sale_order_views.xml
+++ b/fusion_faxes/views/sale_order_views.xml
@@ -8,16 +8,17 @@
         <field name="inherit_id" ref="sale.view_order_form"/>
         <field name="arch" type="xml">
 
-            <!-- Smart button for fax count -->
+            <!-- Smart button for fax count (fax users only) -->
             <xpath expr="//div[@name='button_box']" position="inside">
                 <button name="action_view_faxes" type="object"
                         class="oe_stat_button" icon="fa-fax"
-                        invisible="x_ff_fax_count == 0">
+                        invisible="x_ff_fax_count == 0"
+                        groups="fusion_faxes.group_fax_user">
                     <field name="x_ff_fax_count" widget="statinfo" string="Faxes"/>
                 </button>
             </xpath>
 
-            <!-- Send Fax header button -->
+            <!-- Send Fax header button (fax users only) -->
             <xpath expr="//header" position="inside">
                 <button name="action_send_fax" string="Send Fax"
                         type="object" class="btn-secondary"
diff --git a/fusion_ringcentral/security/ir.model.access.csv b/fusion_ringcentral/security/ir.model.access.csv
index f3ec759..63bbfd2 100644
--- a/fusion_ringcentral/security/ir.model.access.csv
+++ b/fusion_ringcentral/security/ir.model.access.csv
@@ -1,9 +1,11 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_rc_config_manager,rc.config.manager,model_rc_config,group_rc_manager,1,1,1,1
+access_rc_call_history_base,rc.call.history.base.read,model_rc_call_history,base.group_user,1,0,0,0
 access_rc_call_history_user,rc.call.history.user,model_rc_call_history,group_rc_user,1,1,1,0
 access_rc_call_history_company,rc.call.history.company,model_rc_call_history,group_rc_company_user,1,1,1,0
 access_rc_call_history_manager,rc.call.history.manager,model_rc_call_history,group_rc_manager,1,1,1,1
 access_rc_call_dashboard_user,rc.call.dashboard.user,model_rc_call_dashboard,group_rc_user,1,1,1,1
+access_rc_voicemail_base,rc.voicemail.base.read,model_rc_voicemail,base.group_user,1,0,0,0
 access_rc_voicemail_user,rc.voicemail.user,model_rc_voicemail,group_rc_user,1,1,1,0
 access_rc_voicemail_company,rc.voicemail.company,model_rc_voicemail,group_rc_company_user,1,1,1,0
 access_rc_voicemail_manager,rc.voicemail.manager,model_rc_voicemail,group_rc_manager,1,1,1,1
diff --git a/fusion_ringcentral/security/security.xml b/fusion_ringcentral/security/security.xml
index 0beaeb4..e21240a 100644
--- a/fusion_ringcentral/security/security.xml
+++ b/fusion_ringcentral/security/security.xml
@@ -50,6 +50,33 @@
 
     <data noupdate="0">
 
+        <!-- ============================================================ -->
+        <!-- Base read rules (allow computed fields on res.partner to     -->
+        <!-- work for users without RC groups)                             -->
+        <!-- ============================================================ -->
+
+        <record id="rule_call_base_read" model="ir.rule">
+            <field name="name">RC Call: all internal users read-only</field>
+            <field name="model_id" ref="model_rc_call_history"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
+        <record id="rule_voicemail_base_read" model="ir.rule">
+            <field name="name">RC Voicemail: all internal users read-only</field>
+            <field name="model_id" ref="model_rc_voicemail"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
         <!-- ============================================================ -->
         <!-- Call History record rules                                     -->
         <!-- ============================================================ -->
diff --git a/fusion_ringcentral/views/fusion_fax_views.xml b/fusion_ringcentral/views/fusion_fax_views.xml
index 833daa3..35f482f 100644
--- a/fusion_ringcentral/views/fusion_fax_views.xml
+++ b/fusion_ringcentral/views/fusion_fax_views.xml
@@ -8,34 +8,39 @@
         <field name="inherit_id" ref="fusion_faxes.view_fusion_fax_form"/>
         <field name="arch" type="xml">
 
-            <!-- Add Forward and Send New buttons to header -->
+            <!-- Add Forward and Send New buttons to header (RC users only) -->
             <xpath expr="//button[@name='action_resend']" position="after">
                 <button name="action_forward_fax" string="Forward Fax"
                         type="object" class="btn-secondary"
                         icon="fa-share"
-                        invisible="direction != 'inbound' or state != 'received'"/>
+                        invisible="direction != 'inbound' or state != 'received'"
+                        groups="fusion_ringcentral.group_rc_user"/>
                 <button name="action_send_new_fax" string="Send New Fax"
                         type="object" class="btn-secondary"
-                        icon="fa-fax"/>
+                        icon="fa-fax"
+                        groups="fusion_ringcentral.group_rc_user"/>
             </xpath>
 
-            <!-- Add Contact, Sales Orders, Invoices smart buttons -->
+            <!-- Add Contact, Sales Orders, Invoices smart buttons (RC users only) -->
             <xpath expr="//div[@name='button_box']" position="inside">
                 <button name="action_view_contact" type="object"
                         class="oe_stat_button" icon="fa-user"
-                        invisible="not partner_id">
+                        invisible="not partner_id"
+                        groups="fusion_ringcentral.group_rc_user">
                     <div class="o_stat_info">
                         <span class="o_stat_text"><field name="partner_id" readonly="1" nolabel="1" class="o_text_overflow"/></span>
                     </div>
                 </button>
                 <button name="action_view_sale_orders" type="object"
                         class="oe_stat_button" icon="fa-shopping-cart"
-                        invisible="not partner_id">
+                        invisible="not partner_id"
+                        groups="fusion_ringcentral.group_rc_user">
                     <field name="sale_order_count" widget="statinfo" string="Sales Orders"/>
                 </button>
                 <button name="action_view_invoices" type="object"
                         class="oe_stat_button" icon="fa-file-text-o"
-                        invisible="not partner_id">
+                        invisible="not partner_id"
+                        groups="fusion_ringcentral.group_rc_user">
                     <field name="invoice_count" widget="statinfo" string="Invoices"/>
                 </button>
             </xpath>
diff --git a/fusion_ringcentral/views/res_config_settings_views.xml b/fusion_ringcentral/views/res_config_settings_views.xml
index 675a6cc..63d1b9b 100644
--- a/fusion_ringcentral/views/res_config_settings_views.xml
+++ b/fusion_ringcentral/views/res_config_settings_views.xml
@@ -7,7 +7,8 @@
         <field name="inherit_id" ref="base.res_config_settings_view_form"/>
         <field name="arch" type="xml">
             <xpath expr="//form" position="inside">
-                <app data-string="Fusion RingCentral" string="Fusion RingCentral" name="fusion_ringcentral">
+                <app data-string="Fusion RingCentral" string="Fusion RingCentral" name="fusion_ringcentral"
+                     groups="fusion_ringcentral.group_rc_manager">
                     <h2>AI Transcription</h2>
                     <div class="row mt-4 o_settings_container">
                         <div class="col-12 col-lg-6 o_setting_box">
diff --git a/fusion_ringcentral/views/res_partner_views.xml b/fusion_ringcentral/views/res_partner_views.xml
index 756460f..6b83b24 100644
--- a/fusion_ringcentral/views/res_partner_views.xml
+++ b/fusion_ringcentral/views/res_partner_views.xml
@@ -8,19 +8,21 @@
         <field name="inherit_id" ref="base.view_partner_form"/>
         <field name="arch" type="xml">
 
-            <!-- Smart button for call count -->
+            <!-- Smart button for call count (RC users only) -->
             <xpath expr="//div[@name='button_box']" position="inside">
                 <button name="action_view_rc_calls" type="object"
                         class="oe_stat_button" icon="fa-phone"
-                        invisible="rc_call_count == 0">
+                        invisible="rc_call_count == 0"
+                        groups="fusion_ringcentral.group_rc_user">
                     <field name="rc_call_count" widget="statinfo" string="Calls"/>
                 </button>
             </xpath>
 
-            <!-- RingCentral Calls tab -->
+            <!-- RingCentral Calls tab (RC users only) -->
             <xpath expr="//page[@name='internal_notes']" position="after">
                 <page string="RingCentral Calls" name="rc_calls"
-                      invisible="rc_call_count == 0">
+                      invisible="rc_call_count == 0"
+                      groups="fusion_ringcentral.group_rc_user">
                     <field name="rc_call_ids" readonly="1">
                         <list decoration-danger="status in ('missed', 'no_answer')"
                               decoration-success="status == 'answered'">