From bf4464ba37e3867b85425302df17875b9d4d01aa Mon Sep 17 00:00:00 2001
From: gsinghpal <gur_preet.singh@outlook.com>
Date: Thu, 21 May 2026 00:16:05 -0400
Subject: [PATCH] fix(fusion_repairs): Bundle 4 review - lock cert editing +
 drop flex in PDF

H1+H2: Field technicians had perm_create=1 perm_write=1 on inspection
certs (could forge or edit issued certs). Reduced to read-only - the
visit-report wizard already sudos when creating new certs from a tech
visit. Added rule_inspection_cert_readonly for the dispatcher group so
even dispatchers cannot edit already-issued certs; only the manager can
revoke/correct. Sealed audit trail.

H3: Replaced display:flex / gap (which wkhtmltopdf 0.12 renders as a
vertical stack) with inline-block + margin in the certificate PDF.
Footer uses float left/right for the cert-number / inspector signature
line so the layout survives wkhtmltopdf rendering.

Bumped to 19.0.1.4.1.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 fusion_repairs/__manifest__.py                |  2 +-
 .../report/inspection_certificate_report.xml  | 21 +++++++++++++------
 fusion_repairs/security/ir.model.access.csv   |  2 +-
 fusion_repairs/security/security.xml          | 13 ++++++++++++
 4 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/fusion_repairs/__manifest__.py b/fusion_repairs/__manifest__.py
index 160fbd7e..b5dae8aa 100644
--- a/fusion_repairs/__manifest__.py
+++ b/fusion_repairs/__manifest__.py
@@ -4,7 +4,7 @@
 
 {
     'name': 'Fusion Repairs',
-    'version': '19.0.1.4.0',
+    'version': '19.0.1.4.1',
     'category': 'Inventory/Repairs',
     'summary': 'Guided medical equipment repair intake, dispatch, maintenance, and self-service portal',
     'description': """
diff --git a/fusion_repairs/report/inspection_certificate_report.xml b/fusion_repairs/report/inspection_certificate_report.xml
index d7849b04..0e8fe1ca 100644
--- a/fusion_repairs/report/inspection_certificate_report.xml
+++ b/fusion_repairs/report/inspection_certificate_report.xml
@@ -52,15 +52,18 @@
                                 font-weight: 600;
                                 margin-bottom: 12mm;
                             }
+                            /* wkhtmltopdf does not implement flex/gap reliably -
+                               use inline-block layout instead. */
                             .cert-info {
-                                display: flex;
-                                justify-content: center;
-                                gap: 18mm;
                                 margin: 10mm 0;
+                                text-align: center;
                             }
                             .cert-info-item {
+                                display: inline-block;
                                 font-size: 10pt;
                                 text-align: left;
+                                margin: 0 9mm;
+                                vertical-align: top;
                             }
                             .cert-info-item .label {
                                 text-transform: uppercase;
@@ -75,22 +78,28 @@
                             }
                             .cert-footer {
                                 margin-top: 18mm;
-                                display: flex;
-                                justify-content: space-between;
-                                align-items: flex-end;
+                                width: 100%;
+                            }
+                            .cert-footer-row {
+                                width: 100%;
                             }
                             .cert-sig {
+                                display: inline-block;
                                 font-size: 10pt;
                                 color: #666;
                                 border-top: 1px solid #999;
                                 padding-top: 2mm;
                                 width: 70mm;
                                 text-align: center;
+                                float: right;
                             }
                             .cert-number {
+                                display: inline-block;
                                 font-size: 9pt;
                                 color: #888;
                                 font-family: ui-monospace, monospace;
+                                float: left;
+                                padding-top: 6mm;
                             }
                         </style>
                         <div class="cert-wrap">
diff --git a/fusion_repairs/security/ir.model.access.csv b/fusion_repairs/security/ir.model.access.csv
index f4d1859a..33381e5b 100644
--- a/fusion_repairs/security/ir.model.access.csv
+++ b/fusion_repairs/security/ir.model.access.csv
@@ -29,4 +29,4 @@ access_qr_sticker_wizard_user,QR Sticker Wizard User Full,model_fusion_repair_qr
 access_repair_inspection_user,Inspection Cert User Read,model_fusion_repair_inspection_certificate,group_fusion_repairs_user,1,0,0,0
 access_repair_inspection_dispatcher,Inspection Cert Dispatcher,model_fusion_repair_inspection_certificate,group_fusion_repairs_dispatcher,1,1,1,0
 access_repair_inspection_manager,Inspection Cert Manager Full,model_fusion_repair_inspection_certificate,group_fusion_repairs_manager,1,1,1,1
-access_repair_inspection_technician,Inspection Cert Field Tech Create,model_fusion_repair_inspection_certificate,fusion_tasks.group_field_technician,1,1,1,0
+access_repair_inspection_technician,Inspection Cert Field Tech Read-Only,model_fusion_repair_inspection_certificate,fusion_tasks.group_field_technician,1,0,0,0
diff --git a/fusion_repairs/security/security.xml b/fusion_repairs/security/security.xml
index 1344c82a..dcbe4bc1 100644
--- a/fusion_repairs/security/security.xml
+++ b/fusion_repairs/security/security.xml
@@ -138,6 +138,19 @@
         <field name="global" eval="True"/>
     </record>
 
+    <!-- Inspection certs: only manager can edit AFTER issue (everyone else read-only).
+         Visit-report wizard uses sudo() to create new certs from a tech visit. -->
+    <record id="rule_inspection_cert_readonly" model="ir.rule">
+        <field name="name">Inspection Certificate: Read-only for non-managers</field>
+        <field name="model_id" ref="model_fusion_repair_inspection_certificate"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('group_fusion_repairs_dispatcher'))]"/>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="False"/>
+    </record>
+
     <!-- Sales Rep Portal: sees only repair orders they submitted -->
     <record id="rule_repair_order_sales_rep_portal" model="ir.rule">
         <field name="name">Repair Order: Sales Rep Portal - Own Repairs</field>