Account module massive expansion: 2499→5049 LOC (+2550)
New models (12): - account.asset: depreciation (linear/degressive), journal entry generation - account.edi.format + account.edi.document: UBL 2.1 XML e-invoicing - account.followup.line: payment follow-up escalation levels - account.reconcile.model + lines: automatic bank reconciliation rules - crossovered.budget + lines + account.budget.post: budgeting system - account.cash.rounding: invoice rounding (UP/DOWN/HALF-UP) - account.payment.method + lines: payment method definitions - account.invoice.send: invoice sending wizard Enhanced existing: - account.move: action_reverse (credit notes), access_url, invoice_has_outstanding - account.move.line: tax_tag_ids, analytic_distribution, date_maturity, matching_number - Entry hash chain integrity (SHA-256, secure_sequence_number) - Report HTML rendering for all 6 report types - res.partner extended with followup status + overdue tracking Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Marc
285
addons/account/models/account_lock.go
Normal file
285
addons/account/models/account_lock.go
Normal file
@@ -0,0 +1,285 @@
|
||||
package models
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"odoo-go/pkg/orm"
|
||||
)
|
||||
|
||||
// initAccountLock registers entry locking and hash chain integrity features.
|
||||
// Mirrors: odoo/addons/account/models/account_move.py (hash chain features)
|
||||
//
|
||||
// France, Belgium and other countries require an immutable audit trail.
|
||||
// Posted entries are hashed in sequence; any tampering breaks the chain.
|
||||
func initAccountLock() {
|
||||
ext := orm.ExtendModel("account.move")
|
||||
|
||||
ext.AddFields(
|
||||
orm.Char("inalterable_hash", orm.FieldOpts{
|
||||
String: "Inalterability Hash",
|
||||
Readonly: true,
|
||||
Help: "Secure hash for preventing tampering with posted entries",
|
||||
}),
|
||||
orm.Char("secure_sequence_number", orm.FieldOpts{
|
||||
String: "Inalterability No.",
|
||||
Readonly: true,
|
||||
}),
|
||||
orm.Boolean("restrict_mode_hash_table", orm.FieldOpts{
|
||||
String: "Lock with Hash",
|
||||
Related: "journal_id.restrict_mode_hash_table",
|
||||
}),
|
||||
orm.Char("string_to_hash", orm.FieldOpts{
|
||||
String: "Data to Hash",
|
||||
Compute: "_compute_string_to_hash",
|
||||
Help: "Concatenation of fields used for hashing",
|
||||
}),
|
||||
)
|
||||
|
||||
// _compute_string_to_hash: generates the string representation of the move
|
||||
// used for hash computation. Includes date, journal, partner, amounts.
|
||||
// Mirrors: odoo/addons/account/models/account_move.py _compute_string_to_hash()
|
||||
ext.RegisterCompute("string_to_hash", func(rs *orm.Recordset) (orm.Values, error) {
|
||||
env := rs.Env()
|
||||
moveID := rs.IDs()[0]
|
||||
|
||||
var name, moveType, state string
|
||||
var date interface{}
|
||||
var companyID, journalID int64
|
||||
var partnerID *int64
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(name, '/'), COALESCE(move_type, 'entry'), COALESCE(state, 'draft'),
|
||||
date, COALESCE(company_id, 0), COALESCE(journal_id, 0), partner_id
|
||||
FROM account_move WHERE id = $1`, moveID,
|
||||
).Scan(&name, &moveType, &state, &date, &companyID, &journalID, &partnerID)
|
||||
|
||||
// Include line amounts
|
||||
rows, err := env.Tx().Query(env.Ctx(),
|
||||
`SELECT COALESCE(account_id, 0), COALESCE(debit::float8, 0), COALESCE(credit::float8, 0),
|
||||
COALESCE(name, '')
|
||||
FROM account_move_line WHERE move_id = $1 ORDER BY id`, moveID)
|
||||
if err != nil {
|
||||
return orm.Values{"string_to_hash": ""}, nil
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var lineData []string
|
||||
for rows.Next() {
|
||||
var accID int64
|
||||
var debit, credit float64
|
||||
var label string
|
||||
rows.Scan(&accID, &debit, &credit, &label)
|
||||
lineData = append(lineData, fmt.Sprintf("%d|%.2f|%.2f|%s", accID, debit, credit, label))
|
||||
}
|
||||
|
||||
pid := int64(0)
|
||||
if partnerID != nil {
|
||||
pid = *partnerID
|
||||
}
|
||||
|
||||
hashStr := fmt.Sprintf("%s|%s|%v|%d|%d|%d|%s",
|
||||
name, moveType, date, companyID, journalID, pid,
|
||||
strings.Join(lineData, ";"))
|
||||
|
||||
return orm.Values{"string_to_hash": hashStr}, nil
|
||||
})
|
||||
|
||||
// action_hash_entry: computes and stores the hash for a posted entry.
|
||||
// Mirrors: odoo/addons/account/models/account_move.py _hash_move()
|
||||
ext.RegisterMethod("action_hash_entry", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
|
||||
env := rs.Env()
|
||||
for _, moveID := range rs.IDs() {
|
||||
var state string
|
||||
var journalID int64
|
||||
var restrictHash bool
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(m.state, 'draft'), COALESCE(m.journal_id, 0),
|
||||
COALESCE(j.restrict_mode_hash_table, false)
|
||||
FROM account_move m
|
||||
LEFT JOIN account_journal j ON j.id = m.journal_id
|
||||
WHERE m.id = $1`, moveID,
|
||||
).Scan(&state, &journalID, &restrictHash)
|
||||
|
||||
if state != "posted" || !restrictHash {
|
||||
continue
|
||||
}
|
||||
|
||||
// Already hashed?
|
||||
var existingHash *string
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT inalterable_hash FROM account_move WHERE id = $1`, moveID,
|
||||
).Scan(&existingHash)
|
||||
if existingHash != nil && *existingHash != "" {
|
||||
continue // already hashed
|
||||
}
|
||||
|
||||
// Get the string to hash
|
||||
var stringToHash string
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(name, '/') || '|' || COALESCE(move_type, 'entry') || '|' ||
|
||||
COALESCE(date::text, '') || '|' || COALESCE(company_id::text, '0')
|
||||
FROM account_move WHERE id = $1`, moveID,
|
||||
).Scan(&stringToHash)
|
||||
|
||||
// Include lines
|
||||
lineRows, _ := env.Tx().Query(env.Ctx(),
|
||||
`SELECT COALESCE(account_id, 0), COALESCE(debit::float8, 0), COALESCE(credit::float8, 0)
|
||||
FROM account_move_line WHERE move_id = $1 ORDER BY id`, moveID)
|
||||
if lineRows != nil {
|
||||
for lineRows.Next() {
|
||||
var accID int64
|
||||
var debit, credit float64
|
||||
lineRows.Scan(&accID, &debit, &credit)
|
||||
stringToHash += fmt.Sprintf("|%d:%.2f:%.2f", accID, debit, credit)
|
||||
}
|
||||
lineRows.Close()
|
||||
}
|
||||
|
||||
// Get previous hash in the chain
|
||||
var prevHash string
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(inalterable_hash, '')
|
||||
FROM account_move
|
||||
WHERE journal_id = $1 AND state = 'posted' AND inalterable_hash IS NOT NULL
|
||||
AND inalterable_hash != '' AND id < $2
|
||||
ORDER BY secure_sequence_number DESC, id DESC LIMIT 1`,
|
||||
journalID, moveID,
|
||||
).Scan(&prevHash)
|
||||
|
||||
// Compute hash: SHA-256 of (previous_hash + string_to_hash)
|
||||
hashInput := prevHash + stringToHash
|
||||
hash := sha256.Sum256([]byte(hashInput))
|
||||
hashHex := fmt.Sprintf("%x", hash)
|
||||
|
||||
// Get next secure sequence number
|
||||
var nextSeq int64
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(MAX(CAST(secure_sequence_number AS INTEGER)), 0) + 1
|
||||
FROM account_move WHERE journal_id = $1 AND secure_sequence_number IS NOT NULL`,
|
||||
journalID,
|
||||
).Scan(&nextSeq)
|
||||
|
||||
env.Tx().Exec(env.Ctx(),
|
||||
`UPDATE account_move SET inalterable_hash = $1, secure_sequence_number = $2 WHERE id = $3`,
|
||||
hashHex, fmt.Sprintf("%d", nextSeq), moveID)
|
||||
}
|
||||
return true, nil
|
||||
})
|
||||
|
||||
// action_check_hash_integrity: verify the hash chain for a journal.
|
||||
// Mirrors: odoo/addons/account/models/account_move.py _check_hash_integrity()
|
||||
ext.RegisterMethod("action_check_hash_integrity", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
|
||||
env := rs.Env()
|
||||
moveID := rs.IDs()[0]
|
||||
|
||||
var journalID int64
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(journal_id, 0) FROM account_move WHERE id = $1`, moveID,
|
||||
).Scan(&journalID)
|
||||
|
||||
if journalID == 0 {
|
||||
return nil, fmt.Errorf("account: no journal found for move %d", moveID)
|
||||
}
|
||||
|
||||
// Read all hashed entries for this journal in order
|
||||
rows, err := env.Tx().Query(env.Ctx(),
|
||||
`SELECT id, COALESCE(inalterable_hash, ''),
|
||||
COALESCE(name, '/') || '|' || COALESCE(move_type, 'entry') || '|' ||
|
||||
COALESCE(date::text, '') || '|' || COALESCE(company_id::text, '0')
|
||||
FROM account_move
|
||||
WHERE journal_id = $1 AND state = 'posted'
|
||||
AND inalterable_hash IS NOT NULL AND inalterable_hash != ''
|
||||
ORDER BY CAST(secure_sequence_number AS INTEGER), id`, journalID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("account: query hashed entries: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
prevHash := ""
|
||||
entryCount := 0
|
||||
for rows.Next() {
|
||||
var id int64
|
||||
var storedHash, baseStr string
|
||||
if err := rows.Scan(&id, &storedHash, &baseStr); err != nil {
|
||||
return nil, fmt.Errorf("account: scan hash entry: %w", err)
|
||||
}
|
||||
|
||||
// Include lines for this entry
|
||||
lineRows, _ := env.Tx().Query(env.Ctx(),
|
||||
`SELECT COALESCE(account_id, 0), COALESCE(debit::float8, 0), COALESCE(credit::float8, 0)
|
||||
FROM account_move_line WHERE move_id = $1 ORDER BY id`, id)
|
||||
stringToHash := baseStr
|
||||
if lineRows != nil {
|
||||
for lineRows.Next() {
|
||||
var accID int64
|
||||
var debit, credit float64
|
||||
lineRows.Scan(&accID, &debit, &credit)
|
||||
stringToHash += fmt.Sprintf("|%d:%.2f:%.2f", accID, debit, credit)
|
||||
}
|
||||
lineRows.Close()
|
||||
}
|
||||
|
||||
// Verify hash
|
||||
hashInput := prevHash + stringToHash
|
||||
expectedHash := sha256.Sum256([]byte(hashInput))
|
||||
expectedHex := fmt.Sprintf("%x", expectedHash)
|
||||
|
||||
if storedHash != expectedHex {
|
||||
return map[string]interface{}{
|
||||
"status": "corrupted",
|
||||
"message": fmt.Sprintf("Hash chain broken at entry %d", id),
|
||||
"entries_checked": entryCount,
|
||||
}, nil
|
||||
}
|
||||
|
||||
prevHash = storedHash
|
||||
entryCount++
|
||||
}
|
||||
|
||||
return map[string]interface{}{
|
||||
"status": "valid",
|
||||
"message": "All entries verified successfully",
|
||||
"entries_checked": entryCount,
|
||||
}, nil
|
||||
})
|
||||
}
|
||||
|
||||
// initAccountSequence registers sequence generation helpers for accounting.
|
||||
// Mirrors: odoo/addons/account/models/sequence_mixin.py
|
||||
func initAccountSequence() {
|
||||
// account.sequence.mixin fields on account.move (already mostly handled via sequence_prefix/number)
|
||||
// This extends with the date-range based sequences
|
||||
ext := orm.ExtendModel("account.move")
|
||||
ext.AddFields(
|
||||
orm.Char("highest_name", orm.FieldOpts{
|
||||
String: "Highest Name",
|
||||
Compute: "_compute_highest_name",
|
||||
Help: "Technical: highest sequence name in the same journal for ordering",
|
||||
}),
|
||||
orm.Boolean("made_sequence_hole", orm.FieldOpts{
|
||||
String: "Sequence Hole",
|
||||
Help: "Technical: whether this entry created a gap in the sequence",
|
||||
Default: false,
|
||||
}),
|
||||
)
|
||||
|
||||
ext.RegisterCompute("highest_name", func(rs *orm.Recordset) (orm.Values, error) {
|
||||
env := rs.Env()
|
||||
moveID := rs.IDs()[0]
|
||||
|
||||
var journalID int64
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(journal_id, 0) FROM account_move WHERE id = $1`, moveID,
|
||||
).Scan(&journalID)
|
||||
|
||||
var highest string
|
||||
env.Tx().QueryRow(env.Ctx(),
|
||||
`SELECT COALESCE(MAX(name), '/') FROM account_move
|
||||
WHERE journal_id = $1 AND name != '/' AND state = 'posted'`,
|
||||
journalID,
|
||||
).Scan(&highest)
|
||||
|
||||
return orm.Values{"highest_name": highest}, nil
|
||||
})
|
||||
}
|
||||
Reference in New Issue
Block a user