bfc138251a
Per user request: technicians on the tablet should only see Discuss, To-do, Plating, AI, Maintenance, Time Off. Every other top-level app menu (Calendar, Contacts, CRM, Sales, Dashboards, RC, Faxes, Field Service, Fusion Clock, Invoicing, Accounting, Project, Timesheets, Planning, Shipping, Website, Purchase, Inventory, Sign, HR, Payroll, Attendances, Recruitment, Expenses, IoT, Link Tracker, Apps) is now restricted to a new group_fp_office_user. Architecture: - New group_fp_office_user (security/fp_menu_visibility.xml) — a marker group that controls back-office menu visibility. - Owner / Manager / Quality Manager / Shop Manager / Sales Rep all imply office_user via implied_ids — they see everything they did before. - Pure Technicians do NOT imply office_user — they see only the tablet-friendly menus. - A "!technician" filter would have hit managers too (because Manager → ... → Technician via implication), so office_user is the inverse pattern that gets the right scoping. Implementation: - post_init_hook + migrations/19.0.21.4.0/post-migrate.py both call _fp_apply_office_user_menu_visibility(env) which iterates a curated list of menu xmlids and sets group_ids = [office_user] on each. - Uses env.ref(..., raise_if_not_found=False) so menus from uninstalled modules silently skip — no hard depends added. - ir.ui.menu uses `group_ids` in Odoo 19 (was groups_id pre-18 — same rename pattern as res.users; CLAUDE.md Rule 13c). - Settings / Apps / Tests left untouched (already admin-restricted). - Some menus (Field Service) end up with office_user OR their original group — that's correct behavior: Plating Techs have neither so still don't see them; explicit Field Technicians keep access. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>