From aa8161f764e2c76d69a1b537ceb0d47bee22cb56 Mon Sep 17 00:00:00 2001 From: gsinghpal Date: Sun, 24 May 2026 10:28:58 -0400 Subject: [PATCH] fix(shopfloor): sudo job recordset in /fp/workspace/load (rule 13m) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same pattern as plant_kanban — workspace payload denormalizes cross-module fields Technician can't read directly (sale.order, fp.part.catalog, customer_spec, etc.). job.sudo() at the top so the whole render path is sudo'd. Job Workspace was stuck on 'Loading...' with a server-error toast because the route returned {ok:false, error:'...'} (27-byte response) when the first cross-module field access AccessError'd. Module version: 19.0.32.0.9 -> 19.0.32.0.10 Co-Authored-By: Claude Opus 4.7 (1M context) --- fusion_plating/fusion_plating_shopfloor/__manifest__.py | 2 +- .../controllers/workspace_controller.py | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/fusion_plating/fusion_plating_shopfloor/__manifest__.py b/fusion_plating/fusion_plating_shopfloor/__manifest__.py index 7158e071..5f310dbe 100644 --- a/fusion_plating/fusion_plating_shopfloor/__manifest__.py +++ b/fusion_plating/fusion_plating_shopfloor/__manifest__.py @@ -5,7 +5,7 @@ { 'name': 'Fusion Plating — Shop Floor', - 'version': '19.0.32.0.9', + 'version': '19.0.32.0.10', 'category': 'Manufacturing/Plating', 'summary': 'Shop-floor tablet stations, QR scanning, bake window enforcer, ' 'first-piece inspection gates.', diff --git a/fusion_plating/fusion_plating_shopfloor/controllers/workspace_controller.py b/fusion_plating/fusion_plating_shopfloor/controllers/workspace_controller.py index 899d6810..d332c09c 100644 --- a/fusion_plating/fusion_plating_shopfloor/controllers/workspace_controller.py +++ b/fusion_plating/fusion_plating_shopfloor/controllers/workspace_controller.py @@ -37,7 +37,11 @@ class FpWorkspaceController(http.Controller): @http.route('/fp/workspace/load', type='jsonrpc', auth='user') def load(self, job_id): env = request.env - job = env['fp.job'].browse(int(job_id)) + # Sudo: workspace payload denormalizes cross-module fields + # (sale.order, fp.part.catalog, fusion.plating.customer.spec, etc.) + # that low-priv roles (Technician) can't read directly. Caller's + # access to fp.job itself is the security gate. + job = env['fp.job'].sudo().browse(int(job_id)) if not job.exists(): _logger.warning("workspace/load: job %s not found", job_id) return {'ok': False, 'error': f'Job {job_id} not found'}