-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Thanks — ticket
+
#
+ created
with attachment(s).
+ You'll get replies by email, and can follow up under
My Tickets.
+
+
+
+ attachment(s) could not be uploaded.
+ Open the ticket from My Tickets and add them there.
+
+
+
+
+
+
+
+
+
+
+
+ Loading your tickets…
+
+
+
+
+
+
+ No tickets yet. Use the New tab to report a bug or request a feature.
+
+
-
-
-
-
-
-
- Thanks — ticket
-
- #
- created
with attachment(s).
+
+
+
+ Loading…
+
+
+
+
+
+
+ No messages yet.
+
+
+
+
+
+
+
+
+
+ attachment(s) —
+ open the full ticket to download.
+
+
+
+
+
+
+
+
+
+
+
+
-
-
+
+
+
+
+
+
+
+
+
+
+
diff --git a/fusion_helpdesk/static/src/xml/fusion_helpdesk_systray.xml b/fusion_helpdesk/static/src/xml/fusion_helpdesk_systray.xml
index 4aefb028..9d9bbdfe 100644
--- a/fusion_helpdesk/static/src/xml/fusion_helpdesk_systray.xml
+++ b/fusion_helpdesk/static/src/xml/fusion_helpdesk_systray.xml
@@ -5,11 +5,14 @@
diff --git a/fusion_helpdesk/tests/__init__.py b/fusion_helpdesk/tests/__init__.py
new file mode 100644
index 00000000..ef0e8181
--- /dev/null
+++ b/fusion_helpdesk/tests/__init__.py
@@ -0,0 +1,3 @@
+# -*- coding: utf-8 -*-
+from . import test_utils
+from . import test_seen
diff --git a/fusion_helpdesk/tests/test_seen.py b/fusion_helpdesk/tests/test_seen.py
new file mode 100644
index 00000000..e3862232
--- /dev/null
+++ b/fusion_helpdesk/tests/test_seen.py
@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Nexa Systems Inc.
+# License OPL-1
+"""Tests for fusion.helpdesk.ticket.seen read-tracking."""
+from odoo.tests import TransactionCase, tagged
+
+
+@tagged('post_install', '-at_install', 'fusion_helpdesk')
+class TestSeen(TransactionCase):
+
+ def test_mark_seen_upserts_and_is_monotonic(self):
+ Seen = self.env['fusion.helpdesk.ticket.seen']
+ Seen._mark_seen(central_ticket_id=42, last_message_id=100)
+ Seen._mark_seen(central_ticket_id=42, last_message_id=120)
+ Seen._mark_seen(central_ticket_id=42, last_message_id=90) # stale, ignored
+ rec = Seen.search([
+ ('user_id', '=', self.env.uid),
+ ('central_ticket_id', '=', 42),
+ ])
+ self.assertEqual(len(rec), 1, "should upsert, not duplicate")
+ self.assertEqual(rec.last_seen_message_id, 120, "monotonic — never moves back")
+
+ def test_seen_map(self):
+ Seen = self.env['fusion.helpdesk.ticket.seen']
+ Seen._mark_seen(1, 10)
+ Seen._mark_seen(2, 20)
+ self.assertEqual(Seen._seen_map([1, 2, 3]), {1: 10, 2: 20})
diff --git a/fusion_helpdesk/tests/test_utils.py b/fusion_helpdesk/tests/test_utils.py
new file mode 100644
index 00000000..3943b68e
--- /dev/null
+++ b/fusion_helpdesk/tests/test_utils.py
@@ -0,0 +1,131 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Nexa Systems Inc.
+# License OPL-1
+"""Unit tests for the pure helpers in fusion_helpdesk.utils.
+
+These need no live central Odoo — they pin the identity keystone, the
+scoping security boundary, the public-message filter and the unread
+maths as plain data transformations.
+"""
+from odoo.tests import TransactionCase, tagged
+
+from odoo.addons.fusion_helpdesk.utils import (
+ build_ticket_vals,
+ build_scope_domain,
+ is_public_message,
+ compute_unread_count,
+ _norm_email,
+)
+
+
+@tagged('post_install', '-at_install', 'fusion_helpdesk')
+class TestBuildTicketVals(TransactionCase):
+
+ def test_identity_fields_present(self):
+ vals = build_ticket_vals(
+ kind='bug', subject='X', body_html='
b
',
+ team_id=1, client_label='ENTECH',
+ reporter_name='John Doe', reporter_email='john@entech.com',
+ company_name='ENTECH Inc',
+ )
+ self.assertEqual(vals['partner_email'], 'john@entech.com')
+ self.assertEqual(vals['partner_name'], 'John Doe')
+ self.assertEqual(vals['x_fc_client_label'], 'ENTECH')
+ self.assertEqual(vals['partner_company_name'], 'ENTECH Inc')
+ self.assertEqual(vals['team_id'], 1)
+ self.assertIn('X', vals['name'])
+ self.assertIn('[ENTECH]', vals['name'])
+
+ def test_no_email_omits_partner_email(self):
+ vals = build_ticket_vals(
+ kind='feature', subject='Y', body_html='
b
',
+ team_id=False, client_label='', reporter_name='Jane',
+ reporter_email='', company_name='',
+ )
+ self.assertNotIn('partner_email', vals) # never send an empty email
+ self.assertNotIn('team_id', vals) # omit falsy team
+ self.assertNotIn('x_fc_client_label', vals) # omit empty label
+ self.assertEqual(vals['partner_name'], 'Jane')
+ self.assertIn('Feature Request', vals['name'])
+
+
+@tagged('post_install', '-at_install', 'fusion_helpdesk')
+class TestScopeDomain(TransactionCase):
+
+ def test_regular_scope_binds_email_and_label(self):
+ dom = build_scope_domain(label='ENTECH', email='john@entech.com', is_admin=False)
+ self.assertIn(('x_fc_client_label', '=', 'ENTECH'), dom)
+ self.assertIn(('partner_email', '=ilike', 'john@entech.com'), dom)
+
+ def test_admin_scope_binds_label_only(self):
+ dom = build_scope_domain(label='ENTECH', email='a@entech.com', is_admin=True)
+ self.assertIn(('x_fc_client_label', '=', 'ENTECH'), dom)
+ self.assertFalse(any(t[0] == 'partner_email' for t in dom))
+
+ def test_empty_label_never_matches_everything(self):
+ dom = build_scope_domain(label='', email='', is_admin=True)
+ # label term must be present and must NOT be an empty string
+ label_terms = [t for t in dom if t[0] == 'x_fc_client_label']
+ self.assertEqual(len(label_terms), 1)
+ self.assertNotEqual(label_terms[0][2], '')
+
+ def test_wildcard_email_cannot_widen_scope(self):
+ # IDOR guard: a self-set email of '%' must NOT become a match-all
+ # =ilike term — the wildcard has to be escaped to a literal.
+ dom = build_scope_domain(label='ENTECH', email='%', is_admin=False)
+ email_terms = [t for t in dom if t[0] == 'partner_email']
+ self.assertEqual(len(email_terms), 1)
+ self.assertEqual(email_terms[0][2], '\\%',
+ "'%' must be escaped so ILIKE matches it literally")
+
+ def test_underscore_in_real_email_is_escaped_but_preserved(self):
+ dom = build_scope_domain(label='ENTECH', email='john_doe@x.com', is_admin=False)
+ email_terms = [t for t in dom if t[0] == 'partner_email']
+ self.assertEqual(email_terms[0][2], 'john\\_doe@x.com')
+
+
+@tagged('post_install', '-at_install', 'fusion_helpdesk')
+class TestMessageFilterAndUnread(TransactionCase):
+
+ def test_internal_note_is_not_public(self):
+ self.assertFalse(is_public_message({'subtype_is_internal': True}))
+ self.assertTrue(is_public_message({'subtype_is_internal': False}))
+ self.assertTrue(is_public_message({})) # default visible
+
+ def test_unread_count(self):
+ tickets = [
+ {'id': 1, 'last_support_msg_id': 10}, # seen 10 -> read
+ {'id': 2, 'last_support_msg_id': 5}, # seen 3 -> unread
+ {'id': 3, 'last_support_msg_id': 0}, # no support msg
+ ]
+ seen = {1: 10, 2: 3}
+ self.assertEqual(compute_unread_count(tickets, seen), 1)
+
+ def test_unread_count_unseen_ticket_counts(self):
+ tickets = [{'id': 9, 'last_support_msg_id': 4}]
+ self.assertEqual(compute_unread_count(tickets, {}), 1)
+
+
+@tagged('post_install', '-at_install', 'fusion_helpdesk')
+class TestNormEmail(TransactionCase):
+
+ def test_valid_email_is_normalised_lowercase(self):
+ self.assertEqual(_norm_email('John@Entech.COM'), 'john@entech.com')
+
+ def test_first_valid_candidate_wins(self):
+ # confirmed reply email empty -> fall back to the next valid one
+ self.assertEqual(_norm_email('', 'not an email', 'jane@x.com'), 'jane@x.com')
+
+ def test_wildcard_is_rejected(self):
+ # IDOR guard: a self-set '%' must not survive as a scope key
+ self.assertEqual(_norm_email('%'), '')
+
+ def test_non_email_login_falls_through_to_empty(self):
+ self.assertEqual(_norm_email('admin', 'also-not-email', ''), '')
+
+ def test_controller_namespace_resolves_norm_email(self):
+ # Regression: _norm_email was called in controllers/main.py
+ # (submit + _identity) but never imported/defined -> NameError on
+ # every inbox endpoint. Guard that the name is resolvable there.
+ from odoo.addons.fusion_helpdesk.controllers import main
+ self.assertTrue(hasattr(main, '_norm_email'))
diff --git a/fusion_helpdesk/utils.py b/fusion_helpdesk/utils.py
new file mode 100644
index 00000000..1c0bcc02
--- /dev/null
+++ b/fusion_helpdesk/utils.py
@@ -0,0 +1,117 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Nexa Systems Inc.
+# License OPL-1
+"""Pure helpers for fusion_helpdesk.
+
+No Odoo environment, no `request` — just data in, data out. Everything
+here is unit-testable in isolation, which is what lets us validate the
+identity keystone, the server-side scoping boundary, the public-message
+filter and the unread maths without a live central Odoo to talk to.
+"""
+from odoo.tools import email_normalize
+
+# Sentinel used so a missing label/email can never widen a domain to
+# "match everything". An empty string in `=`/`=ilike` would match rows
+# whose field is also empty; '__none__' will simply match nothing.
+_NO_MATCH = '__none__'
+
+
+def escape_like(value):
+ """Escape SQL LIKE/ILIKE wildcards so a user-supplied value can never
+ widen an `=ilike` match to other rows.
+
+ `res.users.email` is self-writeable and unvalidated, so without this a
+ user could set their email to ``%`` and have ``partner_email =ilike '%'``
+ match EVERY ticket in their deployment (a cross-user IDOR). Escaping the
+ backslash first, then ``%`` and ``_``, makes those characters match
+ literally. Real emails containing ``_`` (e.g. ``john_doe@x.com``) keep
+ working — the underscore is matched as a literal, which is what we want.
+ """
+ return (value or '').replace('\\', '\\\\').replace('%', '\\%').replace('_', '\\_')
+
+
+def _norm_email(*candidates):
+ """Return the first candidate that normalises to a valid email, else ''.
+
+ Used to derive the inbox scope key from a chain of fallbacks (the
+ confirmed reply email -> ``user.email`` -> ``user.login``).
+ ``email_normalize`` lowercases the address and returns a falsy value for
+ anything that is not exactly one valid email — including a self-set
+ wildcard like ``%`` — so the value fed into ``build_scope_domain`` can
+ never widen the scope. Pairs with :func:`escape_like` as defense in depth
+ against the ``partner_email =ilike`` IDOR.
+ """
+ for candidate in candidates:
+ normalized = email_normalize(candidate or '')
+ if normalized:
+ return normalized
+ return ''
+
+
+def build_ticket_vals(kind, subject, body_html, team_id, client_label,
+ reporter_name, reporter_email, company_name):
+ """Construct the `helpdesk.ticket` create vals for a forwarded report.
+
+ The identity fields (`partner_email`, `partner_name`,
+ `partner_company_name`) drive native helpdesk find-or-create of the
+ customer partner + follower subscription on the central Odoo, and
+ `x_fc_client_label` tags the deployment for the scoped inbox.
+ """
+ kind_label = 'Bug Report' if kind == 'bug' else 'Feature Request'
+ prefix = ('[%s] ' % client_label) if client_label else ''
+ vals = {
+ 'name': '%s%s: %s' % (prefix, kind_label, subject or '(untitled)'),
+ 'description': body_html,
+ 'partner_name': reporter_name or '',
+ }
+ if team_id:
+ vals['team_id'] = team_id
+ if reporter_email:
+ vals['partner_email'] = reporter_email
+ if company_name:
+ vals['partner_company_name'] = company_name
+ if client_label:
+ vals['x_fc_client_label'] = client_label
+ return vals
+
+
+def build_scope_domain(label, email, is_admin):
+ """Server-side ticket scope for the embedded inbox.
+
+ `x_fc_client_label` is ALWAYS bound (defense in depth) so neither a
+ regular user nor a deployment admin can ever read another
+ deployment's tickets — even though the shared bot can technically see
+ every ticket on the central Odoo. Regular users are additionally
+ bound to their own `partner_email`.
+ """
+ domain = [('x_fc_client_label', '=', label or _NO_MATCH)]
+ if not is_admin:
+ safe_email = escape_like(email)
+ domain.append(('partner_email', '=ilike', safe_email or _NO_MATCH))
+ return domain
+
+
+def is_public_message(msg):
+ """True when a message is customer-visible (not an internal note).
+
+ `msg` is a plain dict carrying a `subtype_is_internal` flag resolved
+ from the central `mail.message.subtype`. Internal notes must never be
+ shown to a client in the embedded inbox.
+ """
+ return not msg.get('subtype_is_internal', False)
+
+
+def compute_unread_count(tickets, seen_by_id):
+ """Number of tickets with a support reply the user hasn't seen.
+
+ `tickets` is a list of dicts each carrying `id` and
+ `last_support_msg_id` (id of the latest customer-visible support
+ message, 0 if none). `seen_by_id` maps central ticket id -> last
+ message id the user has seen (absent => 0 baseline).
+ """
+ count = 0
+ for ticket in tickets:
+ last = ticket.get('last_support_msg_id') or 0
+ if last and last > (seen_by_id.get(ticket['id']) or 0):
+ count += 1
+ return count
diff --git a/fusion_helpdesk_central/__manifest__.py b/fusion_helpdesk_central/__manifest__.py
index e1199021..8f2f61e7 100644
--- a/fusion_helpdesk_central/__manifest__.py
+++ b/fusion_helpdesk_central/__manifest__.py
@@ -3,7 +3,7 @@
# License OPL-1
{
'name': 'Fusion Helpdesk Central — Client API Keys',
- 'version': '19.0.1.0.2',
+ 'version': '19.0.1.1.0',
'category': 'Productivity',
'summary': 'Admin UI on the central Odoo for issuing per-client API '
'keys used by fusion_helpdesk client deployments.',
@@ -28,7 +28,9 @@ Depends only on `helpdesk`. No client-side install needed.
'data': [
'security/ir.model.access.csv',
'data/ir_config_parameter_data.xml',
+ 'data/mail_template_ack.xml',
'views/fusion_helpdesk_client_key_views.xml',
+ 'views/helpdesk_ticket_views.xml',
],
'installable': True,
'auto_install': False,
diff --git a/fusion_helpdesk_central/data/mail_template_ack.xml b/fusion_helpdesk_central/data/mail_template_ack.xml
new file mode 100644
index 00000000..7efdfa6a
--- /dev/null
+++ b/fusion_helpdesk_central/data/mail_template_ack.xml
@@ -0,0 +1,55 @@
+
+
+
+
+
+ Helpdesk: Ticket Acknowledgement (Fusion)
+
+ We received your request [{{ object.ticket_ref or object.id }}]
+ {{ object.partner_id.id }}
+ {{ object.partner_id.lang }}
+
+
+
+
Hello ,
+
+ Thanks for reaching out — we've received your request and our
+ support team will be in touch. Here are the details:
+
+
+
+ | Reference |
+ |
+
+
+ | Subject |
+ |
+
+
+
+
+ View & track your ticket
+
+
+
+ You can reply directly to this email to add information, follow up
+ from the link above, or sign up for an account from that page to
+ manage all of your requests in one place.
+
+
—
+
diff --git a/fusion_helpdesk_central/models/__init__.py b/fusion_helpdesk_central/models/__init__.py
index 91073a9b..61b5123a 100644
--- a/fusion_helpdesk_central/models/__init__.py
+++ b/fusion_helpdesk_central/models/__init__.py
@@ -1,2 +1,3 @@
# -*- coding: utf-8 -*-
from . import fusion_helpdesk_client_key
+from . import helpdesk_ticket
diff --git a/fusion_helpdesk_central/models/helpdesk_ticket.py b/fusion_helpdesk_central/models/helpdesk_ticket.py
new file mode 100644
index 00000000..fd9c872b
--- /dev/null
+++ b/fusion_helpdesk_central/models/helpdesk_ticket.py
@@ -0,0 +1,57 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Nexa Systems Inc.
+# License OPL-1
+"""Central-side helpdesk.ticket extensions for the customer follow-up flow.
+
+Adds the `x_fc_client_label` deployment tag (set by the in-app reporter so
+the embedded inbox can scope per client) and sends a branded acknowledgement
+email — carrying the portal magic link — when an in-app ticket is created.
+"""
+import logging
+
+from odoo import api, fields, models
+
+_logger = logging.getLogger(__name__)
+
+
+class HelpdeskTicket(models.Model):
+ _inherit = 'helpdesk.ticket'
+
+ x_fc_client_label = fields.Char(
+ string='Client Deployment', index=True, copy=False,
+ help='Deployment tag (e.g. ENTECH) set by the fusion_helpdesk in-app '
+ 'reporter. Scopes the embedded "My Tickets" inbox per client and '
+ 'lets support filter tickets by originating deployment.',
+ )
+
+ @api.model_create_multi
+ def create(self, vals_list):
+ tickets = super().create(vals_list)
+ tickets._fc_send_ack_email()
+ return tickets
+
+ def _fc_send_ack_email(self):
+ """Send the branded acknowledgement (with magic link) to the customer.
+
+ Only fires for in-app-channel tickets (those tagged with a client
+ label) that have a customer email — external web-form submissions
+ rely on the native website confirmation, so this won't double-send.
+ The whole thing is best-effort: a template/mail failure must never
+ block ticket creation, so we log and move on.
+ """
+ template = self.env.ref(
+ 'fusion_helpdesk_central.mail_template_ticket_ack',
+ raise_if_not_found=False,
+ )
+ if not template:
+ return
+ for ticket in self:
+ if not (ticket.x_fc_client_label and ticket.partner_email):
+ continue
+ try:
+ template.send_mail(ticket.id, force_send=False)
+ except Exception: # noqa: BLE001 — ack must never block create
+ _logger.exception(
+ 'fusion_helpdesk_central: acknowledgement email failed '
+ 'for ticket %s (%s)', ticket.id, ticket.x_fc_client_label,
+ )
diff --git a/fusion_helpdesk_central/tests/__init__.py b/fusion_helpdesk_central/tests/__init__.py
new file mode 100644
index 00000000..2bded2f8
--- /dev/null
+++ b/fusion_helpdesk_central/tests/__init__.py
@@ -0,0 +1,2 @@
+# -*- coding: utf-8 -*-
+from . import test_identity
diff --git a/fusion_helpdesk_central/tests/test_identity.py b/fusion_helpdesk_central/tests/test_identity.py
new file mode 100644
index 00000000..f886efad
--- /dev/null
+++ b/fusion_helpdesk_central/tests/test_identity.py
@@ -0,0 +1,68 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Nexa Systems Inc.
+# License OPL-1
+"""Identity-keystone tests for the central helpdesk extensions.
+
+Runs on an Enterprise environment (helpdesk installed) — e.g. odoo-nexa or
+odoo-trial. Validates that passing partner_email resolves the customer +
+follower (native), that the client label is stored, and that the branded
+acknowledgement only fires for in-app-channel tickets.
+"""
+from odoo.tests import TransactionCase, tagged
+
+
+@tagged('post_install', '-at_install', 'fusion_helpdesk_central')
+class TestTicketIdentity(TransactionCase):
+
+ @classmethod
+ def setUpClass(cls):
+ super().setUpClass()
+ cls.team = cls.env['helpdesk.team'].search([], limit=1)
+
+ def _ack_mails(self, ticket):
+ return self.env['mail.mail'].search([
+ ('model', '=', 'helpdesk.ticket'),
+ ('res_id', '=', ticket.id),
+ ]).filtered(lambda m: 'received your request' in (m.subject or ''))
+
+ def test_partner_resolution_follower_and_label(self):
+ ticket = self.env['helpdesk.ticket'].create({
+ 'name': 'Keystone test',
+ 'team_id': self.team.id,
+ 'partner_email': 'keystone.newperson@example.com',
+ 'partner_name': 'Key Stone',
+ 'x_fc_client_label': 'ENTECH',
+ })
+ self.assertEqual(ticket.x_fc_client_label, 'ENTECH')
+ self.assertTrue(
+ ticket.partner_id,
+ "native create() should find-or-create a partner from partner_email")
+ self.assertEqual(ticket.partner_id.email, 'keystone.newperson@example.com')
+ self.assertIn(
+ ticket.partner_id, ticket.message_partner_ids,
+ "the customer must be subscribed as a follower")
+
+ def test_ack_email_for_inapp_ticket(self):
+ ticket = self.env['helpdesk.ticket'].create({
+ 'name': 'Ack test',
+ 'team_id': self.team.id,
+ 'partner_email': 'ack.person@example.com',
+ 'partner_name': 'Ack Person',
+ 'x_fc_client_label': 'ENTECH',
+ })
+ self.assertTrue(
+ self._ack_mails(ticket),
+ "an in-app ticket with a customer email should get our ack email")
+
+ def test_no_ack_without_client_label(self):
+ # Simulates an external web-form ticket — no client label, so our
+ # acknowledgement must NOT fire (avoids double-acknowledgement).
+ ticket = self.env['helpdesk.ticket'].create({
+ 'name': 'External web ticket',
+ 'team_id': self.team.id,
+ 'partner_email': 'external.web@example.com',
+ 'partner_name': 'External Web',
+ })
+ self.assertFalse(
+ self._ack_mails(ticket),
+ "no client label => our acknowledgement should not send")
diff --git a/fusion_helpdesk_central/views/helpdesk_ticket_views.xml b/fusion_helpdesk_central/views/helpdesk_ticket_views.xml
new file mode 100644
index 00000000..61f73229
--- /dev/null
+++ b/fusion_helpdesk_central/views/helpdesk_ticket_views.xml
@@ -0,0 +1,34 @@
+
+
+
+
+
+ fhc.helpdesk.ticket.list.client_label
+ helpdesk.ticket
+
+
+
+
+
+
+
+
+
+ fhc.helpdesk.ticket.search.client_label
+ helpdesk.ticket
+
+
+
+
+
+
+
+
+
+