.
+ // Mirrors: odoo/addons/sale/models/sale_order.py SaleOrder.action_quotation_send() print variant
+ so.RegisterMethod("action_print", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ soID := rs.IDs()[0]
+ return map[string]interface{}{
+ "type": "ir.actions.report",
+ "report_name": "sale.order",
+ "report_type": "qweb-pdf",
+ "report_file": fmt.Sprintf("/report/pdf/sale.order/%d", soID),
+ "data": map[string]interface{}{"ids": []int64{soID}},
+ }, nil
})
}
@@ -347,37 +699,402 @@ func initSaleOrderLineExtension() {
return orm.Values{"untaxed_amount_invoiced": qtyInvoiced * price * (1 - discount/100)}, nil
})
- // _compute_qty_invoiced: Compute invoiced quantity from linked invoice lines.
- // Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_qty_invoiced()
- sol.RegisterCompute("qty_invoiced", func(rs *orm.Recordset) (orm.Values, error) {
- env := rs.Env()
- lineID := rs.IDs()[0]
- var qtyInvoiced float64
- env.Tx().QueryRow(env.Ctx(),
- `SELECT COALESCE(qty_invoiced, 0) FROM sale_order_line WHERE id = $1`, lineID,
- ).Scan(&qtyInvoiced)
- return orm.Values{"qty_invoiced": qtyInvoiced}, nil
- })
-
- // _compute_qty_to_invoice: Quantity to invoice = qty - qty_invoiced (if delivered policy: qty_delivered - qty_invoiced).
+ // _compute_qty_to_invoice: Quantity to invoice based on invoice policy.
+ // Note: qty_invoiced compute is registered later with full M2M-based logic.
+ // If invoice policy is 'order': product_uom_qty - qty_invoiced
+ // If invoice policy is 'delivery': qty_delivered - qty_invoiced
// Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_qty_to_invoice()
sol.RegisterCompute("qty_to_invoice", func(rs *orm.Recordset) (orm.Values, error) {
env := rs.Env()
lineID := rs.IDs()[0]
- var qty, qtyInvoiced float64
+ var qty, qtyDelivered, qtyInvoiced float64
+ var productID *int64
+ var orderState string
env.Tx().QueryRow(env.Ctx(),
- `SELECT COALESCE(product_uom_qty, 0), COALESCE(qty_invoiced, 0)
- FROM sale_order_line WHERE id = $1`, lineID,
- ).Scan(&qty, &qtyInvoiced)
- toInvoice := qty - qtyInvoiced
+ `SELECT COALESCE(sol.product_uom_qty, 0), COALESCE(sol.qty_delivered, 0),
+ COALESCE(sol.qty_invoiced, 0), sol.product_id,
+ COALESCE(so.state, 'draft')
+ FROM sale_order_line sol
+ JOIN sale_order so ON so.id = sol.order_id
+ WHERE sol.id = $1`, lineID,
+ ).Scan(&qty, &qtyDelivered, &qtyInvoiced, &productID, &orderState)
+
+ if orderState != "sale" && orderState != "done" {
+ return orm.Values{"qty_to_invoice": float64(0)}, nil
+ }
+
+ // Check invoice policy from product template
+ invoicePolicy := "order" // default
+ if productID != nil && *productID > 0 {
+ var policy *string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT pt.invoice_policy FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pp.id = $1`, *productID).Scan(&policy)
+ if policy != nil && *policy != "" {
+ invoicePolicy = *policy
+ }
+ }
+
+ var toInvoice float64
+ if invoicePolicy == "delivery" {
+ toInvoice = qtyDelivered - qtyInvoiced
+ } else {
+ toInvoice = qty - qtyInvoiced
+ }
if toInvoice < 0 {
toInvoice = 0
}
return orm.Values{"qty_to_invoice": toInvoice}, nil
})
+
+ // _compute_qty_delivered: Compute delivered quantity from stock moves.
+ // For products of type 'service', qty_delivered is manual.
+ // For storable/consumable products, sum done stock move quantities.
+ // Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_qty_delivered()
+ // odoo/addons/sale_stock/models/sale_order_line.py (stock moves source)
+ sol.RegisterCompute("qty_delivered", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ lineID := rs.IDs()[0]
+
+ // Check if stock module is loaded
+ if orm.Registry.Get("stock.move") == nil {
+ // No stock module β return existing stored value
+ var delivered float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(qty_delivered, 0) FROM sale_order_line WHERE id = $1`, lineID,
+ ).Scan(&delivered)
+ return orm.Values{"qty_delivered": delivered}, nil
+ }
+
+ // Get product info
+ var productID *int64
+ var productType string
+ var soName string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT sol.product_id, COALESCE(pt.type, 'consu'),
+ COALESCE(so.name, '')
+ FROM sale_order_line sol
+ LEFT JOIN product_product pp ON pp.id = sol.product_id
+ LEFT JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ JOIN sale_order so ON so.id = sol.order_id
+ WHERE sol.id = $1`, lineID,
+ ).Scan(&productID, &productType, &soName)
+
+ // For services, qty_delivered is manual β keep stored value
+ if productType == "service" || productID == nil || *productID == 0 {
+ var delivered float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(qty_delivered, 0) FROM sale_order_line WHERE id = $1`, lineID,
+ ).Scan(&delivered)
+ return orm.Values{"qty_delivered": delivered}, nil
+ }
+
+ // Sum done outgoing stock move quantities for this product + SO origin
+ var delivered float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(sm.product_uom_qty)::float8, 0)
+ FROM stock_move sm
+ JOIN stock_picking sp ON sp.id = sm.picking_id
+ WHERE sm.product_id = $1 AND sm.state = 'done'
+ AND sp.origin = $2
+ AND sm.location_dest_id IN (
+ SELECT id FROM stock_location WHERE usage = 'customer'
+ )`, *productID, soName,
+ ).Scan(&delivered)
+
+ return orm.Values{"qty_delivered": delivered}, nil
+ })
+
+ // _compute_qty_invoiced: Compute invoiced quantity from linked invoice lines.
+ // For real integration, sum quantities from account.move.line linked via the M2M relation.
+ // Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_qty_invoiced()
+ sol.RegisterCompute("qty_invoiced", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ lineID := rs.IDs()[0]
+
+ // Try to get from the M2M relation (sale_order_line_invoice_rel)
+ var qtyInvoiced float64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(
+ CASE WHEN am.move_type = 'out_refund' THEN -aml.quantity ELSE aml.quantity END
+ )::float8, 0)
+ FROM sale_order_line_invoice_rel rel
+ JOIN account_move_line aml ON aml.id = rel.invoice_line_id
+ JOIN account_move am ON am.id = aml.move_id
+ WHERE rel.order_line_id = $1
+ AND am.state != 'cancel'`, lineID,
+ ).Scan(&qtyInvoiced)
+ if err != nil || qtyInvoiced == 0 {
+ // Fallback to stored value
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(qty_invoiced, 0) FROM sale_order_line WHERE id = $1`, lineID,
+ ).Scan(&qtyInvoiced)
+ }
+ return orm.Values{"qty_invoiced": qtyInvoiced}, nil
+ })
+
+ // _compute_name: Product name + description + variant attributes.
+ // Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_name()
+ sol.AddFields(
+ orm.Text("computed_name", orm.FieldOpts{
+ String: "Computed Description", Compute: "_compute_name",
+ }),
+ )
+ sol.RegisterCompute("computed_name", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ lineID := rs.IDs()[0]
+
+ var productID *int64
+ var existingName string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT product_id, COALESCE(name, '') FROM sale_order_line WHERE id = $1`, lineID,
+ ).Scan(&productID, &existingName)
+
+ // If no product, keep existing name
+ if productID == nil || *productID == 0 {
+ return orm.Values{"computed_name": existingName}, nil
+ }
+
+ // Build name from product template + variant attributes
+ var productName, descSale string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(pt.name, ''), COALESCE(pt.description_sale, '')
+ FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pp.id = $1`, *productID,
+ ).Scan(&productName, &descSale)
+
+ // Get variant attribute values
+ attrRows, err := env.Tx().Query(env.Ctx(),
+ `SELECT COALESCE(pav.name, '')
+ FROM product_template_attribute_value ptav
+ JOIN product_attribute_value pav ON pav.id = ptav.product_attribute_value_id
+ JOIN product_product_product_template_attribute_value_rel rel
+ ON rel.product_template_attribute_value_id = ptav.id
+ WHERE rel.product_product_id = $1`, *productID)
+
+ var attrNames []string
+ if err == nil {
+ for attrRows.Next() {
+ var attrName string
+ attrRows.Scan(&attrName)
+ if attrName != "" {
+ attrNames = append(attrNames, attrName)
+ }
+ }
+ attrRows.Close()
+ }
+
+ name := productName
+ if len(attrNames) > 0 {
+ name += " ("
+ for i, a := range attrNames {
+ if i > 0 {
+ name += ", "
+ }
+ name += a
+ }
+ name += ")"
+ }
+ if descSale != "" {
+ name += "\n" + descSale
+ }
+
+ return orm.Values{"computed_name": name}, nil
+ })
+
+ // _compute_discount: Compute discount from pricelist if applicable.
+ // Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_discount()
+ sol.AddFields(
+ orm.Float("computed_discount", orm.FieldOpts{
+ String: "Computed Discount", Compute: "_compute_discount_from_pricelist",
+ }),
+ )
+ sol.RegisterCompute("computed_discount", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ lineID := rs.IDs()[0]
+
+ var productID *int64
+ var orderID int64
+ var priceUnit float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT product_id, order_id, COALESCE(price_unit, 0)
+ FROM sale_order_line WHERE id = $1`, lineID,
+ ).Scan(&productID, &orderID, &priceUnit)
+
+ if productID == nil || *productID == 0 || priceUnit == 0 {
+ return orm.Values{"computed_discount": float64(0)}, nil
+ }
+
+ // Get pricelist from the order
+ var pricelistID *int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT pricelist_id FROM sale_order WHERE id = $1`, orderID,
+ ).Scan(&pricelistID)
+
+ if pricelistID == nil || *pricelistID == 0 {
+ return orm.Values{"computed_discount": float64(0)}, nil
+ }
+
+ // Get the product's list_price as the base price
+ var listPrice float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(pt.list_price, 0)
+ FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pp.id = $1`, *productID,
+ ).Scan(&listPrice)
+
+ if listPrice <= 0 {
+ return orm.Values{"computed_discount": float64(0)}, nil
+ }
+
+ // Check pricelist for a discount-based rule
+ var discountPct float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(price_discount, 0)
+ FROM product_pricelist_item
+ WHERE pricelist_id = $1
+ AND (product_id = $2 OR product_tmpl_id = (
+ SELECT product_tmpl_id FROM product_product WHERE id = $2
+ ) OR (product_id IS NULL AND product_tmpl_id IS NULL))
+ AND (date_start IS NULL OR date_start <= CURRENT_DATE)
+ AND (date_end IS NULL OR date_end >= CURRENT_DATE)
+ ORDER BY
+ CASE WHEN product_id IS NOT NULL THEN 0
+ WHEN product_tmpl_id IS NOT NULL THEN 1
+ ELSE 2 END,
+ min_quantity ASC
+ LIMIT 1`, *pricelistID, *productID,
+ ).Scan(&discountPct)
+
+ return orm.Values{"computed_discount": discountPct}, nil
+ })
+
+ // _compute_invoice_status_line: Enhanced per-line invoice status considering upselling.
+ // Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_invoice_status()
+ sol.RegisterCompute("invoice_status", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ lineID := rs.IDs()[0]
+
+ var qty, qtyDelivered, qtyInvoiced float64
+ var orderState string
+ var isDownpayment bool
+ var productID *int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(sol.product_uom_qty, 0), COALESCE(sol.qty_delivered, 0),
+ COALESCE(sol.qty_invoiced, 0), COALESCE(so.state, 'draft'),
+ COALESCE(sol.is_downpayment, false), sol.product_id
+ FROM sale_order_line sol
+ JOIN sale_order so ON so.id = sol.order_id
+ WHERE sol.id = $1`, lineID,
+ ).Scan(&qty, &qtyDelivered, &qtyInvoiced, &orderState, &isDownpayment, &productID)
+
+ if orderState != "sale" && orderState != "done" {
+ return orm.Values{"invoice_status": "no"}, nil
+ }
+
+ // Down payment that is fully invoiced
+ if isDownpayment && qtyInvoiced >= qty {
+ return orm.Values{"invoice_status": "invoiced"}, nil
+ }
+
+ // Check qty_to_invoice
+ var toInvoice float64
+ invoicePolicy := "order"
+ if productID != nil && *productID > 0 {
+ var policy *string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT pt.invoice_policy FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pp.id = $1`, *productID).Scan(&policy)
+ if policy != nil && *policy != "" {
+ invoicePolicy = *policy
+ }
+ }
+ if invoicePolicy == "delivery" {
+ toInvoice = qtyDelivered - qtyInvoiced
+ } else {
+ toInvoice = qty - qtyInvoiced
+ }
+
+ if toInvoice > 0.001 {
+ return orm.Values{"invoice_status": "to invoice"}, nil
+ }
+
+ // Upselling: ordered qty invoiced on order policy but delivered more
+ if invoicePolicy == "order" && qty >= 0 && qtyDelivered > qty {
+ return orm.Values{"invoice_status": "upselling"}, nil
+ }
+
+ if qtyInvoiced >= qty && qty > 0 {
+ return orm.Values{"invoice_status": "invoiced"}, nil
+ }
+
+ return orm.Values{"invoice_status": "no"}, nil
+ })
+
+ // ββ Feature 4: _compute_product_template_attribute_value_ids βββββββββ
+ // When product_id changes, find available product.template.attribute.value records
+ // for the variant. Returns JSON array of {id, name, attribute_name} objects.
+ // Mirrors: odoo/addons/sale/models/sale_order_line.py SaleOrderLine._compute_product_template_attribute_value_ids()
+ sol.AddFields(
+ orm.Text("product_template_attribute_value_ids", orm.FieldOpts{
+ String: "Product Attribute Values",
+ Compute: "_compute_product_template_attribute_value_ids",
+ }),
+ )
+ sol.RegisterCompute("product_template_attribute_value_ids", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ lineID := rs.IDs()[0]
+
+ var productID *int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT product_id FROM sale_order_line WHERE id = $1`, lineID,
+ ).Scan(&productID)
+
+ if productID == nil || *productID == 0 {
+ return orm.Values{"product_template_attribute_value_ids": "[]"}, nil
+ }
+
+ // Find attribute values for this product variant via the M2M relation
+ attrRows, err := env.Tx().Query(env.Ctx(),
+ `SELECT ptav.id, COALESCE(pav.name, '') AS value_name,
+ COALESCE(pa.name, '') AS attribute_name
+ FROM product_template_attribute_value ptav
+ JOIN product_attribute_value pav ON pav.id = ptav.product_attribute_value_id
+ JOIN product_attribute pa ON pa.id = ptav.attribute_id
+ JOIN product_product_product_template_attribute_value_rel rel
+ ON rel.product_template_attribute_value_id = ptav.id
+ WHERE rel.product_product_id = $1
+ ORDER BY pa.sequence, pa.name`, *productID)
+ if err != nil {
+ return orm.Values{"product_template_attribute_value_ids": "[]"}, nil
+ }
+ defer attrRows.Close()
+
+ type attrVal struct {
+ ID int64 `json:"id"`
+ Name string `json:"name"`
+ AttributeName string `json:"attribute_name"`
+ }
+ var values []attrVal
+ for attrRows.Next() {
+ var av attrVal
+ if err := attrRows.Scan(&av.ID, &av.Name, &av.AttributeName); err != nil {
+ continue
+ }
+ values = append(values, av)
+ }
+
+ jsonBytes, _ := json.Marshal(values)
+ return orm.Values{"product_template_attribute_value_ids": string(jsonBytes)}, nil
+ })
}
// initSaleOrderDiscount registers the sale.order.discount wizard.
+// Enhanced with discount_type: percentage or fixed_amount.
// Mirrors: odoo/addons/sale/wizard/sale_order_discount.py
func initSaleOrderDiscount() {
m := orm.NewModel("sale.order.discount", orm.ModelOpts{
@@ -386,33 +1103,76 @@ func initSaleOrderDiscount() {
})
m.AddFields(
- orm.Float("discount", orm.FieldOpts{String: "Discount (%)", Required: true}),
+ orm.Float("discount", orm.FieldOpts{String: "Discount Value", Required: true}),
+ orm.Selection("discount_type", []orm.SelectionItem{
+ {Value: "percentage", Label: "Percentage"},
+ {Value: "fixed_amount", Label: "Fixed Amount"},
+ }, orm.FieldOpts{String: "Discount Type", Default: "percentage", Required: true}),
orm.Many2one("sale_order_id", "sale.order", orm.FieldOpts{String: "Sale Order"}),
)
// action_apply_discount: Apply the discount to all lines of the SO.
+ // For percentage: sets discount % on each line directly.
+ // For fixed_amount: distributes the fixed amount evenly across all product lines.
// Mirrors: odoo/addons/sale/wizard/sale_order_discount.py action_apply_discount()
m.RegisterMethod("action_apply_discount", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
env := rs.Env()
wizID := rs.IDs()[0]
- var discount float64
+ var discountVal float64
var orderID int64
+ var discountType string
env.Tx().QueryRow(env.Ctx(),
- `SELECT COALESCE(discount, 0), COALESCE(sale_order_id, 0)
+ `SELECT COALESCE(discount, 0), COALESCE(sale_order_id, 0),
+ COALESCE(discount_type, 'percentage')
FROM sale_order_discount WHERE id = $1`, wizID,
- ).Scan(&discount, &orderID)
+ ).Scan(&discountVal, &orderID, &discountType)
if orderID == 0 {
return nil, fmt.Errorf("sale_discount: no sale order linked")
}
- _, err := env.Tx().Exec(env.Ctx(),
- `UPDATE sale_order_line SET discount = $1
- WHERE order_id = $2
- AND (display_type IS NULL OR display_type = '' OR display_type = 'product')`,
- discount, orderID)
- if err != nil {
- return nil, fmt.Errorf("sale_discount: apply discount: %w", err)
+ switch discountType {
+ case "fixed_amount":
+ // Distribute fixed amount evenly across product lines as a percentage
+ // Calculate total undiscounted line amount to determine per-line discount %
+ var totalAmount float64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(product_uom_qty * price_unit)::float8, 0)
+ FROM sale_order_line WHERE order_id = $1
+ AND (display_type IS NULL OR display_type = '' OR display_type = 'product')`,
+ orderID,
+ ).Scan(&totalAmount)
+ if err != nil {
+ return nil, fmt.Errorf("sale_discount: read total: %w", err)
+ }
+ if totalAmount <= 0 {
+ return nil, fmt.Errorf("sale_discount: order has no lines or zero total")
+ }
+
+ // Convert fixed amount to an equivalent percentage of total
+ pct := discountVal / totalAmount * 100
+ if pct > 100 {
+ pct = 100
+ }
+
+ _, err = env.Tx().Exec(env.Ctx(),
+ `UPDATE sale_order_line SET discount = $1
+ WHERE order_id = $2
+ AND (display_type IS NULL OR display_type = '' OR display_type = 'product')`,
+ pct, orderID)
+ if err != nil {
+ return nil, fmt.Errorf("sale_discount: apply fixed discount: %w", err)
+ }
+
+ default: // "percentage"
+ _, err := env.Tx().Exec(env.Ctx(),
+ `UPDATE sale_order_line SET discount = $1
+ WHERE order_id = $2
+ AND (display_type IS NULL OR display_type = '' OR display_type = 'product')`,
+ discountVal, orderID)
+ if err != nil {
+ return nil, fmt.Errorf("sale_discount: apply percentage discount: %w", err)
+ }
}
return true, nil
@@ -441,3 +1201,5 @@ func initResPartnerSaleExtension2() {
return orm.Values{"sale_order_total": total}, nil
})
}
+
+func htmlEscapeStr(s string) string { return html.EscapeString(s) }
diff --git a/addons/sale/models/sale_template.go b/addons/sale/models/sale_template.go
index 0c3f213..589385a 100644
--- a/addons/sale/models/sale_template.go
+++ b/addons/sale/models/sale_template.go
@@ -124,6 +124,42 @@ func initSaleOrderTemplate() {
numDays, int64(orderID))
}
+ // Copy template options as sale.order.option records on the SO
+ optRows, err := env.Tx().Query(env.Ctx(),
+ `SELECT COALESCE(name, ''), product_id, COALESCE(quantity, 1),
+ COALESCE(price_unit, 0), COALESCE(discount, 0), COALESCE(sequence, 10)
+ FROM sale_order_template_option
+ WHERE sale_order_template_id = $1 ORDER BY sequence`, templateID)
+ if err == nil {
+ optionModel := orm.Registry.Get("sale.order.option")
+ if optionModel != nil {
+ optionRS := env.Model("sale.order.option")
+ for optRows.Next() {
+ var oName string
+ var oProdID *int64
+ var oQty, oPrice, oDisc float64
+ var oSeq int
+ if err := optRows.Scan(&oName, &oProdID, &oQty, &oPrice, &oDisc, &oSeq); err != nil {
+ continue
+ }
+ optVals := orm.Values{
+ "order_id": int64(orderID),
+ "name": oName,
+ "quantity": oQty,
+ "price_unit": oPrice,
+ "discount": oDisc,
+ "sequence": oSeq,
+ "is_present": false,
+ }
+ if oProdID != nil {
+ optVals["product_id"] = *oProdID
+ }
+ optionRS.Create(optVals)
+ }
+ }
+ optRows.Close()
+ }
+
return true, nil
})
@@ -290,3 +326,94 @@ func initSaleOrderTemplateOption() {
return result
})
}
+
+// initSaleOrderOption registers sale.order.option β optional products on a specific sale order.
+// When a template with options is applied to an SO, options are copied here.
+// The customer or salesperson can then choose to add them as order lines.
+// Mirrors: odoo/addons/sale_management/models/sale_order_option.py SaleOrderOption
+func initSaleOrderOption() {
+ m := orm.NewModel("sale.order.option", orm.ModelOpts{
+ Description: "Sale Order Option",
+ Order: "sequence, id",
+ })
+
+ m.AddFields(
+ orm.Many2one("order_id", "sale.order", orm.FieldOpts{
+ String: "Sale Order", Required: true, OnDelete: orm.OnDeleteCascade, Index: true,
+ }),
+ orm.Many2one("product_id", "product.product", orm.FieldOpts{
+ String: "Product", Required: true,
+ }),
+ orm.Char("name", orm.FieldOpts{String: "Description", Required: true}),
+ orm.Float("quantity", orm.FieldOpts{String: "Quantity", Default: 1}),
+ orm.Many2one("uom_id", "uom.uom", orm.FieldOpts{String: "Unit of Measure"}),
+ orm.Float("price_unit", orm.FieldOpts{String: "Unit Price"}),
+ orm.Float("discount", orm.FieldOpts{String: "Discount (%)"}),
+ orm.Integer("sequence", orm.FieldOpts{String: "Sequence", Default: 10}),
+ orm.Boolean("is_present", orm.FieldOpts{
+ String: "Present on Order", Default: false,
+ }),
+ )
+
+ // Onchange: product_id β name + price_unit
+ m.RegisterOnchange("product_id", func(env *orm.Environment, vals orm.Values) orm.Values {
+ result := make(orm.Values)
+
+ var productID int64
+ switch v := vals["product_id"].(type) {
+ case int64:
+ productID = v
+ case float64:
+ productID = int64(v)
+ case map[string]interface{}:
+ if id, ok := v["id"]; ok {
+ switch n := id.(type) {
+ case float64:
+ productID = int64(n)
+ case int64:
+ productID = n
+ }
+ }
+ }
+ if productID <= 0 {
+ return result
+ }
+
+ var name string
+ var listPrice float64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(pt.name, ''), COALESCE(pt.list_price, 0)
+ FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pp.id = $1`, productID,
+ ).Scan(&name, &listPrice)
+ if err != nil {
+ return result
+ }
+
+ result["name"] = name
+ result["price_unit"] = listPrice
+ return result
+ })
+
+ // button_add: Add this option as an order line. Delegates to sale.order action_add_option.
+ m.RegisterMethod("button_add", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ optionID := rs.IDs()[0]
+
+ var orderID int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(order_id, 0) FROM sale_order_option WHERE id = $1`, optionID,
+ ).Scan(&orderID)
+ if err != nil || orderID == 0 {
+ return nil, fmt.Errorf("sale_option: no order linked to option %d", optionID)
+ }
+
+ soRS := env.Model("sale.order").Browse(orderID)
+ soModel := orm.Registry.Get("sale.order")
+ if fn, ok := soModel.Methods["action_add_option"]; ok {
+ return fn(soRS, float64(optionID))
+ }
+ return nil, fmt.Errorf("sale_option: action_add_option not found on sale.order")
+ })
+}
diff --git a/addons/stock/models/init.go b/addons/stock/models/init.go
index b725fff..36b87b6 100644
--- a/addons/stock/models/init.go
+++ b/addons/stock/models/init.go
@@ -2,4 +2,5 @@ package models
func Init() {
initStock()
+ initStockIntrastat()
}
diff --git a/addons/stock/models/stock.go b/addons/stock/models/stock.go
index 31d2efe..c4e2709 100644
--- a/addons/stock/models/stock.go
+++ b/addons/stock/models/stock.go
@@ -2,6 +2,7 @@ package models
import (
"fmt"
+ "log"
"time"
"odoo-go/pkg/orm"
@@ -191,6 +192,19 @@ func initStockPicking() {
}),
orm.Text("note", orm.FieldOpts{String: "Notes"}),
orm.Char("origin", orm.FieldOpts{String: "Source Document", Index: true}),
+ orm.Boolean("is_locked", orm.FieldOpts{String: "Is Locked", Default: true}),
+ orm.Boolean("show_check_availability", orm.FieldOpts{
+ String: "Show Check Availability", Compute: "_compute_show_check_availability",
+ }),
+ orm.Boolean("show_validate", orm.FieldOpts{
+ String: "Show Validate", Compute: "_compute_show_validate",
+ }),
+ orm.Many2one("backorder_id", "stock.picking", orm.FieldOpts{
+ String: "Back Order of", Index: true,
+ }),
+ orm.Boolean("has_tracking", orm.FieldOpts{
+ String: "Has Tracking", Compute: "_compute_has_tracking",
+ }),
)
// --- BeforeCreate hook: auto-generate picking reference ---
@@ -198,15 +212,30 @@ func initStockPicking() {
m.BeforeCreate = func(env *orm.Environment, vals orm.Values) error {
name, _ := vals["name"].(string)
if name == "" || name == "/" {
- vals["name"] = fmt.Sprintf("WH/IN/%05d", time.Now().UnixNano()%100000)
+ seq, err := orm.NextByCode(env, "stock.picking")
+ if err != nil || seq == "" {
+ // Fallback: use DB sequence for guaranteed uniqueness
+ var nextVal int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT nextval(pg_get_serial_sequence('stock_picking', 'id'))`).Scan(&nextVal)
+ vals["name"] = fmt.Sprintf("WH/PICK/%05d", nextVal)
+ } else {
+ vals["name"] = seq
+ }
}
return nil
}
+ // --- BeforeWrite hook: prevent modifications on done & locked transfers ---
+ m.BeforeWrite = orm.StateGuard("stock_picking", "state = 'done' AND is_locked = true",
+ []string{"write_uid", "write_date", "is_locked", "message_partner_ids_count"},
+ "cannot modify done & locked transfers β unlock first")
+
// --- Business methods: stock move workflow ---
// action_confirm transitions a picking from draft β confirmed.
- // Confirms all associated stock moves via _action_confirm (which also reserves).
+ // Confirms all associated stock moves via _action_confirm (which also reserves),
+ // then recomputes picking state based on resulting move states.
// Mirrors: stock.picking.action_confirm()
m.RegisterMethod("action_confirm", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
env := rs.Env()
@@ -220,11 +249,6 @@ func initStockPicking() {
if state != "draft" {
return nil, fmt.Errorf("stock: can only confirm draft pickings (picking %d is %q)", id, state)
}
- _, err = env.Tx().Exec(env.Ctx(),
- `UPDATE stock_picking SET state = 'confirmed' WHERE id = $1`, id)
- if err != nil {
- return nil, fmt.Errorf("stock: confirm picking %d: %w", id, err)
- }
// Confirm all draft moves via _action_confirm (which also tries to reserve)
rows, err := env.Tx().Query(env.Ctx(),
@@ -258,35 +282,23 @@ func initStockPicking() {
}
}
- // Update picking state based on move states after reservation
- var allAssigned bool
- err = env.Tx().QueryRow(env.Ctx(),
- `SELECT NOT EXISTS(
- SELECT 1 FROM stock_move
- WHERE picking_id = $1 AND state NOT IN ('assigned', 'done', 'cancel')
- )`, id).Scan(&allAssigned)
- if err != nil {
- return nil, fmt.Errorf("stock: check move states for picking %d: %w", id, err)
- }
- if allAssigned {
- _, err = env.Tx().Exec(env.Ctx(),
- `UPDATE stock_picking SET state = 'assigned' WHERE id = $1`, id)
- if err != nil {
- return nil, fmt.Errorf("stock: update picking %d to assigned: %w", id, err)
- }
+ // Recompute picking state from move states
+ if err := updatePickingStateFromMoves(env, id); err != nil {
+ return nil, fmt.Errorf("stock: update picking %d state after confirm: %w", id, err)
}
}
return true, nil
})
- // action_assign reserves stock for all confirmed/partially_available moves on the picking.
+ // action_assign reserves stock for all confirmed/waiting/partially_available moves on the picking.
+ // Delegates to stock.move._action_assign() then recomputes picking state.
// Mirrors: stock.picking.action_assign()
m.RegisterMethod("action_assign", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
env := rs.Env()
for _, pickingID := range rs.IDs() {
- // Get moves that need reservation
+ // Get moves that need reservation (including waiting state)
rows, err := env.Tx().Query(env.Ctx(),
- `SELECT id FROM stock_move WHERE picking_id = $1 AND state IN ('confirmed', 'partially_available')`, pickingID)
+ `SELECT id FROM stock_move WHERE picking_id = $1 AND state IN ('confirmed', 'waiting', 'partially_available')`, pickingID)
if err != nil {
return nil, fmt.Errorf("stock: read moves for assign picking %d: %w", pickingID, err)
}
@@ -316,45 +328,145 @@ func initStockPicking() {
}
}
- // Update picking state based on move states
- var allAssigned bool
- err = env.Tx().QueryRow(env.Ctx(),
- `SELECT NOT EXISTS(
- SELECT 1 FROM stock_move
- WHERE picking_id = $1 AND state NOT IN ('assigned', 'done', 'cancel')
- )`, pickingID).Scan(&allAssigned)
- if err != nil {
- return nil, fmt.Errorf("stock: check move states for picking %d: %w", pickingID, err)
- }
- if allAssigned {
- _, err = env.Tx().Exec(env.Ctx(),
- `UPDATE stock_picking SET state = 'assigned' WHERE id = $1`, pickingID)
- }
- if err != nil {
- return nil, fmt.Errorf("stock: update picking %d state: %w", pickingID, err)
+ // Recompute picking state from move states
+ if err := updatePickingStateFromMoves(env, pickingID); err != nil {
+ return nil, fmt.Errorf("stock: update picking %d state after assign: %w", pickingID, err)
}
}
return true, nil
})
+ // _update_state_from_move_lines: Recompute picking state when move line quantities change.
+ // If all moves done β done, all cancelled β cancel, mix β assigned/confirmed.
+ // Mirrors: stock.picking._compute_state() triggered by move line changes
+ m.RegisterMethod("_update_state_from_move_lines", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ for _, pickingID := range rs.IDs() {
+ if err := updatePickingStateFromMoves(env, pickingID); err != nil {
+ return nil, fmt.Errorf("stock.picking: _update_state_from_move_lines for %d: %w", pickingID, err)
+ }
+ }
+ return true, nil
+ })
+
+ // _action_split_picking: Split a picking into two.
+ // Moves with qty_done > 0 stay in the current picking, moves without qty_done
+ // are moved to a new picking. Returns the new picking ID.
+ // Mirrors: stock.picking._action_split() / split wizard
+ m.RegisterMethod("_action_split_picking", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ // Find moves WITH qty_done (stay) and WITHOUT qty_done (go to new picking)
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT sm.id,
+ COALESCE((SELECT SUM(sml.quantity) FROM stock_move_line sml WHERE sml.move_id = sm.id), 0) as qty_done
+ FROM stock_move sm
+ WHERE sm.picking_id = $1 AND sm.state NOT IN ('done', 'cancel')`,
+ pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: query moves for split %d: %w", pickingID, err)
+ }
+
+ var movesWithDone, movesWithoutDone []int64
+ for rows.Next() {
+ var moveID int64
+ var qtyDone float64
+ if err := rows.Scan(&moveID, &qtyDone); err != nil {
+ rows.Close()
+ return nil, fmt.Errorf("stock.picking: scan move for split: %w", err)
+ }
+ if qtyDone > 0.005 {
+ movesWithDone = append(movesWithDone, moveID)
+ } else {
+ movesWithoutDone = append(movesWithoutDone, moveID)
+ }
+ }
+ rows.Close()
+
+ if len(movesWithoutDone) == 0 {
+ return map[string]interface{}{"split": false, "message": "All moves have qty_done, nothing to split"}, nil
+ }
+ if len(movesWithDone) == 0 {
+ return map[string]interface{}{"split": false, "message": "No moves have qty_done, nothing to split"}, nil
+ }
+
+ // Read original picking data
+ var name, origin string
+ var pickTypeID, locID, locDestID, companyID int64
+ var partnerID *int64
+ err = env.Tx().QueryRow(env.Ctx(),
+ `SELECT name, COALESCE(origin,''), picking_type_id,
+ location_id, location_dest_id, company_id, partner_id
+ FROM stock_picking WHERE id = $1`, pickingID,
+ ).Scan(&name, &origin, &pickTypeID, &locID, &locDestID, &companyID, &partnerID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: read picking %d for split: %w", pickingID, err)
+ }
+
+ // Create new picking for moves without qty_done
+ newVals := orm.Values{
+ "name": fmt.Sprintf("%s-SPLIT", name),
+ "picking_type_id": pickTypeID,
+ "location_id": locID,
+ "location_dest_id": locDestID,
+ "company_id": companyID,
+ "origin": origin,
+ "backorder_id": pickingID,
+ "state": "draft",
+ "scheduled_date": time.Now().Format("2006-01-02"),
+ }
+ if partnerID != nil {
+ newVals["partner_id"] = *partnerID
+ }
+ newPicking, err := env.Model("stock.picking").Create(newVals)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: create split picking for %d: %w", pickingID, err)
+ }
+
+ // Move the no-qty-done moves to the new picking
+ for _, moveID := range movesWithoutDone {
+ _, err := env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move SET picking_id = $1 WHERE id = $2`, newPicking.ID(), moveID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: move %d to split picking: %w", moveID, err)
+ }
+ // Also update move lines
+ _, _ = env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move_line SET picking_id = $1 WHERE move_id = $2`, newPicking.ID(), moveID)
+ }
+
+ return map[string]interface{}{
+ "split": true,
+ "new_picking_id": newPicking.ID(),
+ "kept_moves": len(movesWithDone),
+ "split_moves": len(movesWithoutDone),
+ }, nil
+ })
+
// action_cancel: Cancel a picking and all its moves.
// Mirrors: odoo/addons/stock/models/stock_picking.py StockPicking.action_cancel()
m.RegisterMethod("action_cancel", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
env := rs.Env()
for _, pickingID := range rs.IDs() {
- env.Tx().Exec(env.Ctx(), `UPDATE stock_move SET state = 'cancel' WHERE picking_id = $1`, pickingID)
- env.Tx().Exec(env.Ctx(), `UPDATE stock_picking SET state = 'cancel' WHERE id = $1`, pickingID)
+ if _, err := env.Tx().Exec(env.Ctx(), `UPDATE stock_move SET state = 'cancel' WHERE picking_id = $1`, pickingID); err != nil {
+ return nil, fmt.Errorf("stock.picking: cancel moves for %d: %w", pickingID, err)
+ }
+ if _, err := env.Tx().Exec(env.Ctx(), `UPDATE stock_picking SET state = 'cancel' WHERE id = $1`, pickingID); err != nil {
+ return nil, fmt.Errorf("stock.picking: cancel picking %d: %w", pickingID, err)
+ }
}
return true, nil
})
// button_validate transitions a picking β done via _action_done on its moves.
+ // Checks if all quantities are done; if not, creates a backorder for remaining.
// Properly updates quants and clears reservations.
// Mirrors: stock.picking.button_validate()
m.RegisterMethod("button_validate", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
env := rs.Env()
for _, pickingID := range rs.IDs() {
- // Get all non-cancelled moves for this picking
+ // Step 1: Check if there are any non-cancelled moves
rows, err := env.Tx().Query(env.Ctx(),
`SELECT id FROM stock_move WHERE picking_id = $1 AND state != 'cancel'`, pickingID)
if err != nil {
@@ -378,18 +490,68 @@ func initStockPicking() {
continue
}
- // Call _action_done on all moves
- moveRS := env.Model("stock.move").Browse(moveIDs...)
- moveModel := orm.Registry.Get("stock.move")
- if moveModel != nil {
- if doneMethod, ok := moveModel.Methods["_action_done"]; ok {
- if _, err := doneMethod(moveRS); err != nil {
- return nil, fmt.Errorf("stock: action_done for picking %d: %w", pickingID, err)
+ // Step 1b: Enforce serial/lot tracking β reject if required lot is missing
+ lotErr := enforceSerialLotTracking(env, pickingID)
+ if lotErr != nil {
+ return nil, lotErr
+ }
+
+ // Step 2: Check if any move has remaining qty (demand > qty_done)
+ var hasRemaining bool
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT EXISTS(
+ SELECT 1 FROM stock_move sm
+ WHERE sm.picking_id = $1 AND sm.state NOT IN ('done', 'cancel')
+ AND sm.product_uom_qty > COALESCE(
+ (SELECT SUM(sml.quantity) FROM stock_move_line sml WHERE sml.move_id = sm.id), 0
+ ) + 0.005
+ )`, pickingID,
+ ).Scan(&hasRemaining)
+
+ // Step 3: If partial, create backorder for remaining quantities
+ if hasRemaining {
+ pickModel := orm.Registry.Get("stock.picking")
+ if pickModel != nil {
+ if boMethod, ok := pickModel.Methods["_create_backorder"]; ok {
+ pickRS := env.Model("stock.picking").Browse(pickingID)
+ if _, err := boMethod(pickRS); err != nil {
+ return nil, fmt.Errorf("stock: create backorder for picking %d: %w", pickingID, err)
+ }
}
}
}
- // Update picking state
+ // Step 4: Re-read move IDs (demand may have been adjusted by backorder)
+ rows2, err := env.Tx().Query(env.Ctx(),
+ `SELECT id FROM stock_move WHERE picking_id = $1 AND state NOT IN ('done', 'cancel')`, pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock: re-read moves for picking %d: %w", pickingID, err)
+ }
+ var activeMoveIDs []int64
+ for rows2.Next() {
+ var id int64
+ if err := rows2.Scan(&id); err != nil {
+ rows2.Close()
+ return nil, fmt.Errorf("stock: scan active move for picking %d: %w", pickingID, err)
+ }
+ activeMoveIDs = append(activeMoveIDs, id)
+ }
+ rows2.Close()
+
+ // Step 5: Call _action_done on all active moves
+ if len(activeMoveIDs) > 0 {
+ moveRS := env.Model("stock.move").Browse(activeMoveIDs...)
+ moveModel := orm.Registry.Get("stock.move")
+ if moveModel != nil {
+ if doneMethod, ok := moveModel.Methods["_action_done"]; ok {
+ if _, err := doneMethod(moveRS); err != nil {
+ return nil, fmt.Errorf("stock: action_done for picking %d: %w", pickingID, err)
+ }
+ }
+ }
+ }
+
+ // Step 6: Update picking state to done
_, err = env.Tx().Exec(env.Ctx(),
`UPDATE stock_picking SET state = 'done', date_done = NOW() WHERE id = $1`, pickingID)
if err != nil {
@@ -399,6 +561,414 @@ func initStockPicking() {
return true, nil
})
+ // do_unreserve: Un-reserve all moves on a picking, reset state to confirmed.
+ // Mirrors: odoo/addons/stock/models/stock_picking.py StockPicking.do_unreserve()
+ m.RegisterMethod("do_unreserve", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ for _, pickingID := range rs.IDs() {
+ // Clear reserved quantities on move lines
+ env.Tx().Exec(env.Ctx(),
+ `DELETE FROM stock_move_line WHERE move_id IN (SELECT id FROM stock_move WHERE picking_id = $1 AND state NOT IN ('done','cancel'))`, pickingID)
+ // Reset moves to confirmed
+ env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move SET state = 'confirmed', reserved_availability = 0 WHERE picking_id = $1 AND state NOT IN ('done','cancel')`, pickingID)
+ // Reset picking state to confirmed
+ env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_picking SET state = 'confirmed' WHERE id = $1 AND state NOT IN ('done','cancel')`, pickingID)
+ }
+ return true, nil
+ })
+
+ // _compute_state: Compute picking state from move states.
+ // Mirrors: odoo/addons/stock/models/stock_picking.py StockPicking._compute_state()
+ m.RegisterCompute("state", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ // Count moves by state
+ var total, draftCount, cancelCount, doneCount, assignedCount int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COUNT(*),
+ COUNT(*) FILTER (WHERE state = 'draft'),
+ COUNT(*) FILTER (WHERE state = 'cancel'),
+ COUNT(*) FILTER (WHERE state = 'done'),
+ COUNT(*) FILTER (WHERE state = 'assigned')
+ FROM stock_move WHERE picking_id = $1`, pickingID,
+ ).Scan(&total, &draftCount, &cancelCount, &doneCount, &assignedCount)
+
+ if total == 0 || draftCount > 0 {
+ return orm.Values{"state": "draft"}, nil
+ }
+ if cancelCount == total {
+ return orm.Values{"state": "cancel"}, nil
+ }
+ if doneCount+cancelCount == total {
+ return orm.Values{"state": "done"}, nil
+ }
+ if assignedCount+doneCount+cancelCount == total {
+ return orm.Values{"state": "assigned"}, nil
+ }
+ return orm.Values{"state": "confirmed"}, nil
+ })
+
+ // _compute_show_check_availability: Show button when moves need reservation.
+ // Mirrors: odoo/addons/stock/models/stock_picking.py StockPicking._compute_show_check_availability()
+ m.RegisterCompute("show_check_availability", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ var state string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(state, 'draft') FROM stock_picking WHERE id = $1`, pickingID,
+ ).Scan(&state)
+
+ if state == "done" || state == "cancel" || state == "draft" {
+ return orm.Values{"show_check_availability": false}, nil
+ }
+
+ // Show if any move is not fully reserved
+ var needsReservation bool
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT EXISTS(
+ SELECT 1 FROM stock_move
+ WHERE picking_id = $1 AND state IN ('confirmed', 'partially_available', 'waiting')
+ )`, pickingID,
+ ).Scan(&needsReservation)
+
+ return orm.Values{"show_check_availability": needsReservation}, nil
+ })
+
+ // _compute_show_validate: Show validate button when picking can be validated.
+ // Mirrors: odoo/addons/stock/models/stock_picking.py
+ m.RegisterCompute("show_validate", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ var state string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(state, 'draft') FROM stock_picking WHERE id = $1`, pickingID,
+ ).Scan(&state)
+
+ show := state != "done" && state != "cancel" && state != "draft"
+ return orm.Values{"show_validate": show}, nil
+ })
+
+ // _compute_has_tracking: Check if any move has lot/serial tracking.
+ // Mirrors: stock.picking._compute_has_tracking()
+ m.RegisterCompute("has_tracking", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ var hasTracking bool
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT EXISTS(
+ SELECT 1 FROM stock_move sm
+ JOIN product_product pp ON pp.id = sm.product_id
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE sm.picking_id = $1 AND pt.tracking != 'none'
+ )`, pickingID,
+ ).Scan(&hasTracking)
+
+ return orm.Values{"has_tracking": hasTracking}, nil
+ })
+
+ // action_set_quantities_to_reservation: Set done qty = reserved qty on all moves.
+ // Mirrors: stock.picking.action_set_quantities_to_reservation()
+ m.RegisterMethod("action_set_quantities_to_reservation", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ for _, pickingID := range rs.IDs() {
+ // For each non-done/cancel move, set move line quantities to match reservations
+ _, err := env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move_line SET quantity = reserved_quantity
+ WHERE move_id IN (
+ SELECT id FROM stock_move WHERE picking_id = $1 AND state NOT IN ('done', 'cancel')
+ ) AND reserved_quantity > 0`, pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: action_set_quantities_to_reservation for %d: %w", pickingID, err)
+ }
+
+ // For moves without move lines, create a move line with demand as quantity
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT sm.id, sm.product_id, sm.product_uom, sm.product_uom_qty,
+ sm.location_id, sm.location_dest_id, sm.company_id
+ FROM stock_move sm
+ WHERE sm.picking_id = $1
+ AND sm.state IN ('assigned', 'partially_available')
+ AND NOT EXISTS (SELECT 1 FROM stock_move_line WHERE move_id = sm.id)`,
+ pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: query moves without lines for %d: %w", pickingID, err)
+ }
+
+ type moveInfo struct {
+ ID, ProductID, UomID, LocationID, LocationDestID, CompanyID int64
+ Qty float64
+ }
+ var moves []moveInfo
+ for rows.Next() {
+ var mi moveInfo
+ if err := rows.Scan(&mi.ID, &mi.ProductID, &mi.UomID, &mi.Qty, &mi.LocationID, &mi.LocationDestID, &mi.CompanyID); err != nil {
+ rows.Close()
+ return nil, fmt.Errorf("stock.picking: scan move for set qty: %w", err)
+ }
+ moves = append(moves, mi)
+ }
+ rows.Close()
+
+ for _, mi := range moves {
+ _, err = env.Tx().Exec(env.Ctx(),
+ `INSERT INTO stock_move_line
+ (move_id, product_id, product_uom_id, location_id, location_dest_id, quantity, company_id, date)
+ VALUES ($1, $2, $3, $4, $5, $6, $7, NOW())`,
+ mi.ID, mi.ProductID, mi.UomID, mi.LocationID, mi.LocationDestID, mi.Qty, mi.CompanyID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: create move line for set qty move %d: %w", mi.ID, err)
+ }
+ }
+ }
+ return true, nil
+ })
+
+ // _check_entire_pack: Validate package completeness.
+ // Mirrors: stock.picking._check_entire_pack()
+ // Stub returning true β full package validation would require complete package quant tracking.
+ m.RegisterMethod("_check_entire_pack", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ return true, nil
+ })
+
+ // _compute_entire_package_ids: Compute related package IDs for the picking.
+ // Mirrors: stock.picking._compute_entire_package_ids()
+ m.RegisterMethod("_compute_entire_package_ids", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT DISTINCT sml.package_id FROM stock_move_line sml
+ JOIN stock_move sm ON sm.id = sml.move_id
+ WHERE sm.picking_id = $1 AND sml.package_id IS NOT NULL`, pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: compute entire_package_ids for %d: %w", pickingID, err)
+ }
+ defer rows.Close()
+
+ var packageIDs []int64
+ for rows.Next() {
+ var pkgID int64
+ if err := rows.Scan(&pkgID); err != nil {
+ return nil, fmt.Errorf("stock.picking: scan package_id: %w", err)
+ }
+ packageIDs = append(packageIDs, pkgID)
+ }
+ return packageIDs, nil
+ })
+
+ // _create_backorder: Create a backorder picking for remaining unprocessed quantities.
+ // Copies undone move lines to a new picking linked via backorder_id.
+ // Mirrors: stock.picking._create_backorder()
+ m.RegisterMethod("_create_backorder", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ // Read original picking data
+ var name, state, origin string
+ var pickTypeID, locID, locDestID, companyID int64
+ var partnerID *int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT name, COALESCE(state,'draft'), COALESCE(origin,''), picking_type_id,
+ location_id, location_dest_id, company_id, partner_id
+ FROM stock_picking WHERE id = $1`, pickingID,
+ ).Scan(&name, &state, &origin, &pickTypeID, &locID, &locDestID, &companyID, &partnerID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: read picking %d for backorder: %w", pickingID, err)
+ }
+
+ // Find moves where quantity_done < demand (partially done or not done)
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT sm.id, sm.product_id, sm.product_uom_qty, sm.product_uom,
+ sm.location_id, sm.location_dest_id, sm.company_id, sm.name,
+ COALESCE((SELECT SUM(sml.quantity) FROM stock_move_line sml WHERE sml.move_id = sm.id), 0) as qty_done
+ FROM stock_move sm
+ WHERE sm.picking_id = $1 AND sm.state NOT IN ('done', 'cancel')`,
+ pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: query moves for backorder %d: %w", pickingID, err)
+ }
+
+ type backorderMove struct {
+ ID, ProductID, UomID, LocID, LocDestID, CompanyID int64
+ Demand, QtyDone float64
+ Name string
+ }
+ var movesToBackorder []backorderMove
+ for rows.Next() {
+ var bm backorderMove
+ if err := rows.Scan(&bm.ID, &bm.ProductID, &bm.Demand, &bm.UomID,
+ &bm.LocID, &bm.LocDestID, &bm.CompanyID, &bm.Name, &bm.QtyDone); err != nil {
+ rows.Close()
+ return nil, fmt.Errorf("stock.picking: scan backorder move: %w", err)
+ }
+ remaining := bm.Demand - bm.QtyDone
+ if remaining > 0.005 { // Float tolerance
+ movesToBackorder = append(movesToBackorder, bm)
+ }
+ }
+ rows.Close()
+
+ if len(movesToBackorder) == 0 {
+ return nil, nil // Nothing to backorder
+ }
+
+ // Create backorder picking
+ boVals := orm.Values{
+ "name": fmt.Sprintf("%s-BO", name),
+ "picking_type_id": pickTypeID,
+ "location_id": locID,
+ "location_dest_id": locDestID,
+ "company_id": companyID,
+ "origin": origin,
+ "backorder_id": pickingID,
+ "state": "draft",
+ "scheduled_date": time.Now().Format("2006-01-02"),
+ }
+ if partnerID != nil {
+ boVals["partner_id"] = *partnerID
+ }
+
+ boPicking, err := env.Model("stock.picking").Create(boVals)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: create backorder for %d: %w", pickingID, err)
+ }
+
+ // Create moves in the backorder for the remaining quantities
+ moveRS := env.Model("stock.move")
+ for _, bm := range movesToBackorder {
+ remaining := bm.Demand - bm.QtyDone
+ _, err := moveRS.Create(orm.Values{
+ "name": bm.Name,
+ "product_id": bm.ProductID,
+ "product_uom_qty": remaining,
+ "product_uom": bm.UomID,
+ "location_id": bm.LocID,
+ "location_dest_id": bm.LocDestID,
+ "picking_id": boPicking.ID(),
+ "company_id": bm.CompanyID,
+ "state": "draft",
+ "date": time.Now(),
+ })
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: create backorder move for %d: %w", bm.ID, err)
+ }
+
+ // Reduce demand on original move to match qty_done
+ if bm.QtyDone > 0 {
+ _, err = env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move SET product_uom_qty = $1 WHERE id = $2`,
+ bm.QtyDone, bm.ID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: reduce demand on move %d: %w", bm.ID, err)
+ }
+ }
+ }
+
+ return map[string]interface{}{
+ "backorder_id": boPicking.ID(),
+ }, nil
+ })
+
+ // action_generate_backorder_wizard: When not all qty is done, decide on backorder.
+ // In Python Odoo this opens a wizard; here we auto-create the backorder.
+ // Mirrors: stock.picking.action_generate_backorder_wizard()
+ m.RegisterMethod("action_generate_backorder_wizard", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ pickingID := rs.IDs()[0]
+
+ // Check if all quantities are done
+ var hasRemaining bool
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT EXISTS(
+ SELECT 1 FROM stock_move sm
+ WHERE sm.picking_id = $1 AND sm.state NOT IN ('done', 'cancel')
+ AND sm.product_uom_qty > COALESCE(
+ (SELECT SUM(sml.quantity) FROM stock_move_line sml WHERE sml.move_id = sm.id), 0
+ ) + 0.005
+ )`, pickingID,
+ ).Scan(&hasRemaining)
+
+ if !hasRemaining {
+ return map[string]interface{}{"backorder_needed": false}, nil
+ }
+
+ // Create the backorder
+ pickModel := orm.Registry.Get("stock.picking")
+ if pickModel != nil {
+ if boMethod, ok := pickModel.Methods["_create_backorder"]; ok {
+ result, err := boMethod(rs)
+ if err != nil {
+ return nil, err
+ }
+ return map[string]interface{}{
+ "backorder_needed": true,
+ "backorder": result,
+ }, nil
+ }
+ }
+
+ return map[string]interface{}{"backorder_needed": true}, nil
+ })
+
+ // action_back_to_draft: Reset a cancelled picking back to draft.
+ // Mirrors: odoo/addons/stock/models/stock_picking.py StockPicking.action_back_to_draft()
+ m.RegisterMethod("action_back_to_draft", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ for _, pickingID := range rs.IDs() {
+ var state string
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT state FROM stock_picking WHERE id = $1`, pickingID,
+ ).Scan(&state)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: read state for %d: %w", pickingID, err)
+ }
+ if state != "cancel" {
+ return nil, fmt.Errorf("stock.picking: can only reset cancelled pickings to draft (picking %d is %q)", pickingID, state)
+ }
+
+ // Reset moves to draft
+ _, err = env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move SET state = 'draft' WHERE picking_id = $1 AND state = 'cancel'`, pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: reset moves to draft for %d: %w", pickingID, err)
+ }
+
+ // Reset picking to draft
+ _, err = env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_picking SET state = 'draft' WHERE id = $1`, pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: reset to draft for %d: %w", pickingID, err)
+ }
+ }
+ return true, nil
+ })
+
+ // action_toggle_is_locked: Toggle the is_locked boolean for editing done pickings.
+ // Mirrors: odoo/addons/stock/models/stock_picking.py StockPicking.action_toggle_is_locked()
+ m.RegisterMethod("action_toggle_is_locked", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ for _, pickingID := range rs.IDs() {
+ _, err := env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_picking SET is_locked = NOT COALESCE(is_locked, true) WHERE id = $1`, pickingID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.picking: toggle is_locked for %d: %w", pickingID, err)
+ }
+ }
+ return true, nil
+ })
+
+ // send_receipt: Stub that returns true (for receipt email button).
+ // Mirrors: odoo/addons/stock/models/stock_picking.py StockPicking.send_receipt()
+ m.RegisterMethod("send_receipt", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ return true, nil
+ })
+
// action_return creates a reverse transfer (return picking) with swapped locations.
// Copies all done moves from the original picking to the return picking.
// Mirrors: odoo/addons/stock/wizard/stock_picking_return.py
@@ -484,22 +1054,14 @@ func initStockPicking() {
// updateQuant adjusts the on-hand quantity for a product at a location.
// If no quant row exists yet it inserts one; otherwise it updates in place.
func updateQuant(env *orm.Environment, productID, locationID int64, delta float64) error {
- var exists bool
- err := env.Tx().QueryRow(env.Ctx(),
- `SELECT EXISTS(SELECT 1 FROM stock_quant WHERE product_id = $1 AND location_id = $2)`,
- productID, locationID).Scan(&exists)
- if err != nil {
- return err
- }
- if exists {
- _, err = env.Tx().Exec(env.Ctx(),
- `UPDATE stock_quant SET quantity = quantity + $1 WHERE product_id = $2 AND location_id = $3`,
- delta, productID, locationID)
- } else {
- _, err = env.Tx().Exec(env.Ctx(),
- `INSERT INTO stock_quant (product_id, location_id, quantity, reserved_quantity, company_id) VALUES ($1, $2, $3, 0, 1)`,
- productID, locationID, delta)
- }
+ // Atomic upsert β eliminates TOCTOU race condition between concurrent transactions.
+ // Uses INSERT ON CONFLICT to avoid separate SELECT+UPDATE/INSERT.
+ _, err := env.Tx().Exec(env.Ctx(),
+ `INSERT INTO stock_quant (product_id, location_id, quantity, reserved_quantity, company_id)
+ VALUES ($1, $2, $3, 0, 1)
+ ON CONFLICT (product_id, location_id)
+ DO UPDATE SET quantity = stock_quant.quantity + $3`,
+ productID, locationID, delta)
return err
}
@@ -534,6 +1096,14 @@ func assignMove(env *orm.Environment, moveID int64) error {
return nil
}
+ // Skip if move already has reservation lines (prevent duplicates)
+ var existingLines int
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COUNT(*) FROM stock_move_line WHERE move_id = $1`, moveID).Scan(&existingLines)
+ if existingLines > 0 {
+ return nil
+ }
+
// Check available quantity in source location
available := getAvailableQty(env, productID, locationID)
@@ -608,6 +1178,8 @@ func initStockMove() {
String: "Product", Required: true, Index: true,
}),
orm.Float("product_uom_qty", orm.FieldOpts{String: "Demand", Required: true, Default: 1.0}),
+ orm.Float("quantity_done", orm.FieldOpts{String: "Quantity Done", Compute: "_compute_quantity_done"}),
+ orm.Float("reserved_availability", orm.FieldOpts{String: "Forecast Availability"}),
orm.Many2one("product_uom", "uom.uom", orm.FieldOpts{
String: "UoM", Required: true,
}),
@@ -630,6 +1202,12 @@ func initStockMove() {
}),
orm.Integer("sequence", orm.FieldOpts{String: "Sequence", Default: 10}),
orm.Char("origin", orm.FieldOpts{String: "Source Document"}),
+ orm.Float("forecast_availability", orm.FieldOpts{
+ String: "Forecast Availability", Compute: "_compute_forecast_availability",
+ }),
+ orm.One2many("move_line_ids", "stock.move.line", "move_id", orm.FieldOpts{
+ String: "Move Lines",
+ }),
)
// _compute_value: value = price_unit * product_uom_qty
@@ -692,30 +1270,47 @@ func initStockMove() {
env := rs.Env()
for _, id := range rs.IDs() {
var productID, srcLoc, dstLoc int64
- var qty float64
+ var demandQty float64
err := env.Tx().QueryRow(env.Ctx(),
`SELECT product_id, product_uom_qty, location_id, location_dest_id
- FROM stock_move WHERE id = $1`, id).Scan(&productID, &qty, &srcLoc, &dstLoc)
+ FROM stock_move WHERE id = $1`, id).Scan(&productID, &demandQty, &srcLoc, &dstLoc)
if err != nil {
return nil, fmt.Errorf("stock: read move %d for done: %w", id, err)
}
- // Decrease source quant
- if err := updateQuant(env, productID, srcLoc, -qty); err != nil {
- return nil, fmt.Errorf("stock: update source quant for move %d: %w", id, err)
- }
- // Increase destination quant
- if err := updateQuant(env, productID, dstLoc, qty); err != nil {
- return nil, fmt.Errorf("stock: update dest quant for move %d: %w", id, err)
+ // Use actual done qty from move lines, falling back to demand
+ var doneQty float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(quantity), 0) FROM stock_move_line WHERE move_id = $1`, id,
+ ).Scan(&doneQty)
+ if doneQty == 0 {
+ doneQty = demandQty
}
- // Clear reservation on source quant
- _, err = env.Tx().Exec(env.Ctx(),
- `UPDATE stock_quant SET reserved_quantity = GREATEST(reserved_quantity - $1, 0)
- WHERE product_id = $2 AND location_id = $3`,
- qty, productID, srcLoc)
- if err != nil {
- return nil, fmt.Errorf("stock: clear reservation for move %d: %w", id, err)
+ // Only update quants for internal locations (skip supplier/customer/virtual)
+ var srcUsage, dstUsage string
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(usage, '') FROM stock_location WHERE id = $1`, srcLoc).Scan(&srcUsage)
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(usage, '') FROM stock_location WHERE id = $1`, dstLoc).Scan(&dstUsage)
+
+ if srcUsage == "internal" {
+ if err := updateQuant(env, productID, srcLoc, -doneQty); err != nil {
+ return nil, fmt.Errorf("stock: update source quant for move %d: %w", id, err)
+ }
+ }
+ if dstUsage == "internal" {
+ if err := updateQuant(env, productID, dstLoc, doneQty); err != nil {
+ return nil, fmt.Errorf("stock: update dest quant for move %d: %w", id, err)
+ }
+ }
+
+ // Clear reservation on source quant (only if internal)
+ if srcUsage == "internal" {
+ env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_quant SET reserved_quantity = GREATEST(reserved_quantity - $1, 0)
+ WHERE product_id = $2 AND location_id = $3`,
+ doneQty, productID, srcLoc)
}
// Mark move as done
@@ -724,9 +1319,190 @@ func initStockMove() {
if err != nil {
return nil, fmt.Errorf("stock: done move %d: %w", id, err)
}
+
+ // Multi-location transfer propagation: auto-create chained move if a push rule exists
+ if err := propagateChainedMove(env, id, productID, dstLoc, doneQty); err != nil {
+ log.Printf("stock: chain propagation for move %d: %v", id, err)
+ }
}
return true, nil
})
+
+ // _action_cancel: Cancel stock moves, unreserving any reserved quantities.
+ // Mirrors: odoo/addons/stock/models/stock_move.py StockMove._action_cancel()
+ m.RegisterMethod("_action_cancel", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ env := rs.Env()
+ moveIDs := rs.IDs()
+ if len(moveIDs) == 0 {
+ return true, nil
+ }
+
+ // Check for done moves (cannot cancel)
+ var doneCount int
+ if err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT COUNT(*) FROM stock_move WHERE id = ANY($1) AND state = 'done'`, moveIDs,
+ ).Scan(&doneCount); err != nil {
+ return nil, fmt.Errorf("stock.move: cancel check: %w", err)
+ }
+ if doneCount > 0 {
+ return nil, fmt.Errorf("stock.move: cannot cancel done moves β create a return instead")
+ }
+
+ // Batch release reservations: aggregate reserved qty per product+location
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT sm.product_id, sm.location_id, COALESCE(SUM(sml.quantity), 0)
+ FROM stock_move sm
+ LEFT JOIN stock_move_line sml ON sml.move_id = sm.id
+ WHERE sm.id = ANY($1) AND sm.state NOT IN ('done', 'cancel')
+ GROUP BY sm.product_id, sm.location_id
+ HAVING SUM(sml.quantity) > 0`, moveIDs)
+ if err != nil {
+ return nil, fmt.Errorf("stock.move: cancel reservation query: %w", err)
+ }
+ for rows.Next() {
+ var productID, locationID int64
+ var reserved float64
+ if err := rows.Scan(&productID, &locationID, &reserved); err != nil {
+ rows.Close()
+ return nil, err
+ }
+ env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_quant SET reserved_quantity = GREATEST(reserved_quantity - $1, 0)
+ WHERE product_id = $2 AND location_id = $3`,
+ reserved, productID, locationID)
+ }
+ rows.Close()
+
+ // Batch delete all move lines
+ if _, err := env.Tx().Exec(env.Ctx(),
+ `DELETE FROM stock_move_line WHERE move_id = ANY($1)`, moveIDs); err != nil {
+ return nil, fmt.Errorf("stock.move: delete move lines: %w", err)
+ }
+
+ // Batch update state to cancel (skip already cancelled)
+ if _, err := env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move SET state = 'cancel' WHERE id = ANY($1) AND state != 'cancel'`, moveIDs); err != nil {
+ return nil, fmt.Errorf("stock.move: cancel: %w", err)
+ }
+
+ return true, nil
+ })
+
+ // _compute_quantity_done: Sum of move line quantities.
+ // Mirrors: odoo/addons/stock/models/stock_move.py StockMove._compute_quantity_done()
+ m.RegisterCompute("quantity_done", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ moveID := rs.IDs()[0]
+ var qtyDone float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(quantity), 0) FROM stock_move_line WHERE move_id = $1`, moveID,
+ ).Scan(&qtyDone)
+ return orm.Values{"quantity_done": qtyDone}, nil
+ })
+
+ // _compute_reserved_availability: SUM reserved_quantity from move_lines / product_uom_qty as percentage.
+ // Mirrors: stock.move._compute_reserved_availability()
+ m.RegisterCompute("reserved_availability", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ moveID := rs.IDs()[0]
+
+ var demandQty float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(product_uom_qty, 0) FROM stock_move WHERE id = $1`, moveID,
+ ).Scan(&demandQty)
+
+ if demandQty <= 0 {
+ return orm.Values{"reserved_availability": float64(0)}, nil
+ }
+
+ var reservedQty float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(quantity), 0) FROM stock_move_line WHERE move_id = $1`, moveID,
+ ).Scan(&reservedQty)
+
+ // Return as absolute reserved qty (Odoo convention, not percentage)
+ return orm.Values{"reserved_availability": reservedQty}, nil
+ })
+
+ // _compute_forecast_availability: Check available qty from quants for the move's product+location.
+ // Mirrors: stock.move._compute_forecast_information()
+ m.RegisterCompute("forecast_availability", func(rs *orm.Recordset) (orm.Values, error) {
+ env := rs.Env()
+ moveID := rs.IDs()[0]
+
+ var productID, locationID int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT product_id, location_id FROM stock_move WHERE id = $1`, moveID,
+ ).Scan(&productID, &locationID)
+
+ available := getAvailableQty(env, productID, locationID)
+ return orm.Values{"forecast_availability": available}, nil
+ })
+
+ // _generate_serial_move_line_commands: For serial-tracked products, create one move line per serial.
+ // Expects args: []string of serial numbers.
+ // Mirrors: stock.move._generate_serial_move_line_commands()
+ m.RegisterMethod("_generate_serial_move_line_commands", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 1 {
+ return nil, fmt.Errorf("stock.move._generate_serial_move_line_commands requires serial numbers")
+ }
+ serials, ok := args[0].([]string)
+ if !ok || len(serials) == 0 {
+ return nil, fmt.Errorf("stock.move._generate_serial_move_line_commands: invalid serial numbers argument")
+ }
+
+ env := rs.Env()
+ moveID := rs.IDs()[0]
+
+ // Read move details
+ var productID, uomID, locationID, locationDestID, companyID int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT product_id, product_uom, location_id, location_dest_id, company_id
+ FROM stock_move WHERE id = $1`, moveID,
+ ).Scan(&productID, &uomID, &locationID, &locationDestID, &companyID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.move: read move %d for serial generation: %w", moveID, err)
+ }
+
+ var createdLineIDs []int64
+ for _, serial := range serials {
+ // Find or create the lot
+ var lotID int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM stock_lot WHERE name = $1 AND product_id = $2 LIMIT 1`,
+ serial, productID,
+ ).Scan(&lotID)
+ if err != nil || lotID == 0 {
+ // Create the lot
+ err = env.Tx().QueryRow(env.Ctx(),
+ `INSERT INTO stock_lot (name, product_id, company_id) VALUES ($1, $2, $3) RETURNING id`,
+ serial, productID, companyID,
+ ).Scan(&lotID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.move: create lot for serial %q: %w", serial, err)
+ }
+ }
+
+ // Create move line with qty 1 (one per serial)
+ var lineID int64
+ err = env.Tx().QueryRow(env.Ctx(),
+ `INSERT INTO stock_move_line
+ (move_id, product_id, product_uom_id, lot_id, location_id, location_dest_id, quantity, company_id, date)
+ VALUES ($1, $2, $3, $4, $5, $6, 1, $7, NOW())
+ RETURNING id`,
+ moveID, productID, uomID, lotID, locationID, locationDestID, companyID,
+ ).Scan(&lineID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.move: create serial move line for %q: %w", serial, err)
+ }
+ createdLineIDs = append(createdLineIDs, lineID)
+ }
+
+ return map[string]interface{}{
+ "move_line_ids": createdLineIDs,
+ "count": len(createdLineIDs),
+ }, nil
+ })
}
// initStockMoveLine registers stock.move.line β detailed operations per lot/package.
@@ -834,6 +1610,193 @@ func initStockQuant() {
return true, nil
})
+ // _get_available_quantity: Query available (unreserved) qty for a product at a location.
+ // Optionally filter by lot_id (args[2]).
+ // Mirrors: odoo/addons/stock/models/stock_quant.py StockQuant._get_available_quantity()
+ m.RegisterMethod("_get_available_quantity", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 2 {
+ return nil, fmt.Errorf("stock.quant._get_available_quantity requires product_id, location_id")
+ }
+ productID, _ := args[0].(int64)
+ locationID, _ := args[1].(int64)
+ if productID == 0 || locationID == 0 {
+ return nil, fmt.Errorf("stock.quant._get_available_quantity: invalid product_id or location_id")
+ }
+
+ env := rs.Env()
+ var lotID int64
+ if len(args) >= 3 {
+ lotID, _ = args[2].(int64)
+ }
+
+ var available float64
+ if lotID > 0 {
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(quantity - reserved_quantity), 0)
+ FROM stock_quant
+ WHERE product_id = $1 AND location_id = $2 AND lot_id = $3`,
+ productID, locationID, lotID).Scan(&available)
+ } else {
+ available = getAvailableQty(env, productID, locationID)
+ }
+ return available, nil
+ })
+
+ // _gather: Find quants matching product + location + optional lot criteria.
+ // Returns quant IDs as []int64.
+ // Args: product_id (int64), location_id (int64), optional lot_id (int64).
+ // Mirrors: odoo/addons/stock/models/stock_quant.py StockQuant._gather()
+ m.RegisterMethod("_gather", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 2 {
+ return nil, fmt.Errorf("stock.quant._gather requires product_id, location_id")
+ }
+ productID, _ := args[0].(int64)
+ locationID, _ := args[1].(int64)
+ if productID == 0 || locationID == 0 {
+ return nil, fmt.Errorf("stock.quant._gather: invalid product_id or location_id")
+ }
+
+ env := rs.Env()
+ var lotID int64
+ if len(args) >= 3 {
+ lotID, _ = args[2].(int64)
+ }
+
+ var query string
+ var queryArgs []interface{}
+ if lotID > 0 {
+ query = `SELECT id FROM stock_quant
+ WHERE product_id = $1 AND location_id = $2 AND lot_id = $3
+ ORDER BY in_date, id`
+ queryArgs = []interface{}{productID, locationID, lotID}
+ } else {
+ query = `SELECT id FROM stock_quant
+ WHERE product_id = $1 AND location_id = $2
+ ORDER BY in_date, id`
+ queryArgs = []interface{}{productID, locationID}
+ }
+
+ rows, err := env.Tx().Query(env.Ctx(), query, queryArgs...)
+ if err != nil {
+ return nil, fmt.Errorf("stock.quant._gather: %w", err)
+ }
+ defer rows.Close()
+
+ var quantIDs []int64
+ for rows.Next() {
+ var qid int64
+ if err := rows.Scan(&qid); err != nil {
+ return nil, fmt.Errorf("stock.quant._gather scan: %w", err)
+ }
+ quantIDs = append(quantIDs, qid)
+ }
+ return quantIDs, nil
+ })
+
+ // _compute_qty_at_date: Historical stock query β SUM moves done before a given date.
+ // Args: product_id (int64), location_id (int64), date (string YYYY-MM-DD)
+ // Mirrors: stock.quant._compute_qty_at_date() / stock history
+ m.RegisterMethod("_compute_qty_at_date", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 3 {
+ return nil, fmt.Errorf("stock.quant._compute_qty_at_date requires product_id, location_id, date")
+ }
+ productID, _ := args[0].(int64)
+ locationID, _ := args[1].(int64)
+ dateStr, _ := args[2].(string)
+ if productID == 0 || locationID == 0 || dateStr == "" {
+ return nil, fmt.Errorf("stock.quant._compute_qty_at_date: invalid args")
+ }
+
+ env := rs.Env()
+
+ // Sum incoming moves (destination = this location) done before the date
+ var incoming float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(
+ COALESCE((SELECT SUM(sml.quantity) FROM stock_move_line sml WHERE sml.move_id = sm.id), sm.product_uom_qty)
+ ), 0)
+ FROM stock_move sm
+ WHERE sm.product_id = $1 AND sm.location_dest_id = $2
+ AND sm.state = 'done' AND sm.date <= $3`,
+ productID, locationID, dateStr,
+ ).Scan(&incoming)
+
+ // Sum outgoing moves (source = this location) done before the date
+ var outgoing float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(
+ COALESCE((SELECT SUM(sml.quantity) FROM stock_move_line sml WHERE sml.move_id = sm.id), sm.product_uom_qty)
+ ), 0)
+ FROM stock_move sm
+ WHERE sm.product_id = $1 AND sm.location_id = $2
+ AND sm.state = 'done' AND sm.date <= $3`,
+ productID, locationID, dateStr,
+ ).Scan(&outgoing)
+
+ qtyAtDate := incoming - outgoing
+ return map[string]interface{}{
+ "product_id": productID,
+ "location_id": locationID,
+ "date": dateStr,
+ "qty_at_date": qtyAtDate,
+ "incoming": incoming,
+ "outgoing": outgoing,
+ }, nil
+ })
+
+ // _compute_forecast_qty: on_hand - outgoing_reserved + incoming_confirmed.
+ // Args: product_id (int64), location_id (int64)
+ // Mirrors: stock.quant forecast computation
+ m.RegisterMethod("_compute_forecast_qty", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 2 {
+ return nil, fmt.Errorf("stock.quant._compute_forecast_qty requires product_id, location_id")
+ }
+ productID, _ := args[0].(int64)
+ locationID, _ := args[1].(int64)
+ if productID == 0 || locationID == 0 {
+ return nil, fmt.Errorf("stock.quant._compute_forecast_qty: invalid args")
+ }
+
+ env := rs.Env()
+
+ // On-hand quantity at location
+ var onHand float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(quantity), 0) FROM stock_quant
+ WHERE product_id = $1 AND location_id = $2`,
+ productID, locationID,
+ ).Scan(&onHand)
+
+ // Outgoing reserved: confirmed/assigned moves FROM this location
+ var outgoingReserved float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(product_uom_qty), 0) FROM stock_move
+ WHERE product_id = $1 AND location_id = $2
+ AND state IN ('confirmed', 'assigned', 'waiting', 'partially_available')`,
+ productID, locationID,
+ ).Scan(&outgoingReserved)
+
+ // Incoming confirmed: confirmed/assigned moves TO this location
+ var incomingConfirmed float64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(SUM(product_uom_qty), 0) FROM stock_move
+ WHERE product_id = $1 AND location_dest_id = $2
+ AND state IN ('confirmed', 'assigned', 'waiting', 'partially_available')`,
+ productID, locationID,
+ ).Scan(&incomingConfirmed)
+
+ forecastQty := onHand - outgoingReserved + incomingConfirmed
+
+ return map[string]interface{}{
+ "product_id": productID,
+ "location_id": locationID,
+ "on_hand": onHand,
+ "outgoing_reserved": outgoingReserved,
+ "incoming_confirmed": incomingConfirmed,
+ "forecast_qty": forecastQty,
+ }, nil
+ })
+
// stock.quant.package β physical packages / containers
orm.NewModel("stock.quant.package", orm.ModelOpts{
Description: "Packages",
@@ -913,6 +1876,64 @@ func initStockLot() {
).Scan(&qty)
return orm.Values{"product_qty": qty}, nil
})
+
+ // _generate_serial_numbers: Auto-create sequential lot/serial records for a product.
+ // Args: product_id (int64), prefix (string), count (int64), company_id (int64)
+ // Creates lots named prefix0001, prefix0002, ... prefixNNNN.
+ // Mirrors: stock.lot.generate_lot_names() / serial number generation wizard
+ m.RegisterMethod("_generate_serial_numbers", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 3 {
+ return nil, fmt.Errorf("stock.lot._generate_serial_numbers requires product_id, prefix, count")
+ }
+ productID, _ := args[0].(int64)
+ prefix, _ := args[1].(string)
+ count, _ := args[2].(int64)
+ if productID == 0 || count <= 0 {
+ return nil, fmt.Errorf("stock.lot._generate_serial_numbers: invalid product_id or count")
+ }
+
+ companyID := int64(1)
+ if len(args) >= 4 {
+ if cid, ok := args[3].(int64); ok && cid > 0 {
+ companyID = cid
+ }
+ }
+
+ env := rs.Env()
+ var createdIDs []int64
+ var createdNames []string
+
+ for i := int64(1); i <= count; i++ {
+ lotName := fmt.Sprintf("%s%04d", prefix, i)
+
+ // Check if lot already exists
+ var existingID int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM stock_lot WHERE name = $1 AND product_id = $2 LIMIT 1`,
+ lotName, productID,
+ ).Scan(&existingID)
+ if existingID > 0 {
+ continue // Skip duplicates
+ }
+
+ var lotID int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `INSERT INTO stock_lot (name, product_id, company_id) VALUES ($1, $2, $3) RETURNING id`,
+ lotName, productID, companyID,
+ ).Scan(&lotID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.lot._generate_serial_numbers: create lot %q: %w", lotName, err)
+ }
+ createdIDs = append(createdIDs, lotID)
+ createdNames = append(createdNames, lotName)
+ }
+
+ return map[string]interface{}{
+ "lot_ids": createdIDs,
+ "names": createdNames,
+ "count": len(createdIDs),
+ }, nil
+ })
}
// initStockOrderpoint registers stock.warehouse.orderpoint β reorder rules.
@@ -1171,3 +2192,164 @@ func toInt64(v interface{}) int64 {
}
return 0
}
+
+// updatePickingStateFromMoves recomputes and writes the picking state based on
+// the aggregate states of its stock moves.
+// If all moves done β done, all cancelled β cancel, all assigned+done+cancel β assigned, else confirmed.
+// Mirrors: stock.picking._compute_state()
+func updatePickingStateFromMoves(env *orm.Environment, pickingID int64) error {
+ var total, draftCount, cancelCount, doneCount, assignedCount int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT COUNT(*),
+ COUNT(*) FILTER (WHERE state = 'draft'),
+ COUNT(*) FILTER (WHERE state = 'cancel'),
+ COUNT(*) FILTER (WHERE state = 'done'),
+ COUNT(*) FILTER (WHERE state = 'assigned')
+ FROM stock_move WHERE picking_id = $1`, pickingID,
+ ).Scan(&total, &draftCount, &cancelCount, &doneCount, &assignedCount)
+ if err != nil {
+ return fmt.Errorf("updatePickingStateFromMoves: query move states for picking %d: %w", pickingID, err)
+ }
+
+ var newState string
+ switch {
+ case total == 0 || draftCount > 0:
+ newState = "draft"
+ case cancelCount == total:
+ newState = "cancel"
+ case doneCount+cancelCount == total:
+ newState = "done"
+ case assignedCount+doneCount+cancelCount == total:
+ newState = "assigned"
+ default:
+ newState = "confirmed"
+ }
+
+ _, err = env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_picking SET state = $1 WHERE id = $2`, newState, pickingID)
+ if err != nil {
+ return fmt.Errorf("updatePickingStateFromMoves: update picking %d to %s: %w", pickingID, newState, err)
+ }
+ // If done, also set date_done
+ if newState == "done" {
+ env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_picking SET date_done = NOW() WHERE id = $1 AND date_done IS NULL`, pickingID)
+ }
+ return nil
+}
+
+// propagateChainedMove checks for push rules on the destination location and
+// auto-creates a chained move if a stock.rule exists for the route.
+// This implements multi-location transfer propagation between warehouses.
+// Mirrors: stock.move._push_apply() / _action_done chain
+func propagateChainedMove(env *orm.Environment, moveID, productID, destLocationID int64, qty float64) error {
+ // Look for a push rule where location_src_id = destLocationID
+ var ruleID, nextDestID, pickingTypeID int64
+ var delay int
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT sr.id, sr.location_dest_id, sr.picking_type_id, COALESCE(sr.delay, 0)
+ FROM stock_rule sr
+ WHERE sr.location_src_id = $1
+ AND sr.action IN ('push', 'pull_push')
+ AND sr.active = true
+ ORDER BY sr.sequence LIMIT 1`,
+ destLocationID,
+ ).Scan(&ruleID, &nextDestID, &pickingTypeID, &delay)
+ if err != nil {
+ return nil // No push rule found β this is normal, not an error
+ }
+ if ruleID == 0 || nextDestID == 0 {
+ return nil
+ }
+
+ // Find or create a picking for the chained move
+ var chainedPickingID int64
+ err = env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM stock_picking
+ WHERE picking_type_id = $1 AND location_id = $2 AND location_dest_id = $3
+ AND state = 'draft'
+ ORDER BY id DESC LIMIT 1`,
+ pickingTypeID, destLocationID, nextDestID,
+ ).Scan(&chainedPickingID)
+
+ if chainedPickingID == 0 {
+ // Create a new picking
+ var companyID int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COALESCE(company_id, 1) FROM stock_picking_type WHERE id = $1`, pickingTypeID,
+ ).Scan(&companyID)
+ if companyID == 0 {
+ companyID = 1
+ }
+
+ scheduled := time.Now().AddDate(0, 0, delay).Format("2006-01-02")
+ pickVals := orm.Values{
+ "picking_type_id": pickingTypeID,
+ "location_id": destLocationID,
+ "location_dest_id": nextDestID,
+ "company_id": companyID,
+ "state": "draft",
+ "scheduled_date": scheduled,
+ "origin": fmt.Sprintf("Chain from move %d", moveID),
+ }
+ pickRS, err := env.Model("stock.picking").Create(pickVals)
+ if err != nil {
+ return fmt.Errorf("propagateChainedMove: create picking: %w", err)
+ }
+ chainedPickingID = pickRS.ID()
+ }
+
+ // Create the chained move
+ scheduled := time.Now().AddDate(0, 0, delay)
+ _, err = env.Model("stock.move").Create(orm.Values{
+ "name": fmt.Sprintf("Chained: product %d from rule %d", productID, ruleID),
+ "product_id": productID,
+ "product_uom_qty": qty,
+ "product_uom": int64(1), // default UoM
+ "location_id": destLocationID,
+ "location_dest_id": nextDestID,
+ "picking_id": chainedPickingID,
+ "company_id": int64(1),
+ "state": "draft",
+ "date": scheduled,
+ "origin": fmt.Sprintf("Chain from move %d", moveID),
+ })
+ if err != nil {
+ return fmt.Errorf("propagateChainedMove: create chained move: %w", err)
+ }
+
+ log.Printf("stock: created chained move for product %d from location %d to %d (rule %d)", productID, destLocationID, nextDestID, ruleID)
+ return nil
+}
+
+// enforceSerialLotTracking validates that move lines have required lot/serial numbers.
+// Products with tracking = 'lot' or 'serial' must have lot_id set on their move lines.
+// Mirrors: odoo/addons/stock/models/stock_picking.py _check_move_lines_map_quant()
+func enforceSerialLotTracking(env *orm.Environment, pickingID int64) error {
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT sml.id, COALESCE(pt.name, ''), COALESCE(pt.tracking, 'none'), sml.lot_id
+ FROM stock_move_line sml
+ JOIN stock_move sm ON sm.id = sml.move_id
+ LEFT JOIN product_product pp ON pp.id = sml.product_id
+ LEFT JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE sm.picking_id = $1 AND sm.state NOT IN ('done', 'cancel')
+ AND sml.quantity > 0`, pickingID)
+ if err != nil {
+ log.Printf("stock: serial/lot tracking query failed for picking %d: %v", pickingID, err)
+ return fmt.Errorf("stock: cannot verify lot/serial tracking: %w", err)
+ }
+ defer rows.Close()
+
+ for rows.Next() {
+ var lineID int64
+ var productName, tracking string
+ var lotID *int64
+ if err := rows.Scan(&lineID, &productName, &tracking, &lotID); err != nil {
+ continue
+ }
+ if (tracking == "lot" || tracking == "serial") && (lotID == nil || *lotID == 0) {
+ return fmt.Errorf("stock: product '%s' requires a lot/serial number (tracking=%s) on move line %d", productName, tracking, lineID)
+ }
+ }
+ return nil
+}
diff --git a/addons/stock/models/stock_barcode.go b/addons/stock/models/stock_barcode.go
index 97ba587..029aab3 100644
--- a/addons/stock/models/stock_barcode.go
+++ b/addons/stock/models/stock_barcode.go
@@ -72,6 +72,137 @@ func initStockBarcode() {
return map[string]interface{}{"found": false, "barcode": barcode}, nil
})
+ // action_process_barcode: Enhanced barcode scan loop β handles UPC/EAN by searching
+ // product.product.barcode field directly. Supports UPC-A (12 digits), EAN-13 (13 digits),
+ // EAN-8 (8 digits), and arbitrary barcodes. In the context of a picking, increments
+ // qty_done on the matching move line.
+ // Mirrors: stock_barcode.picking barcode scan loop with UPC/EAN support
+ m.RegisterMethod("action_process_barcode", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 2 {
+ return nil, fmt.Errorf("stock.barcode.picking.action_process_barcode requires picking_id, barcode")
+ }
+ pickingID, _ := args[0].(int64)
+ barcode, _ := args[1].(string)
+ if pickingID == 0 || barcode == "" {
+ return nil, fmt.Errorf("stock.barcode.picking: invalid picking_id or barcode")
+ }
+
+ env := rs.Env()
+
+ // Step 1: Try to find product by barcode on product.product.barcode (UPC/EAN stored here)
+ var productID int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM product_product WHERE barcode = $1 LIMIT 1`, barcode,
+ ).Scan(&productID)
+
+ // Step 2: If not found on product_product, try product_template.barcode
+ if productID == 0 {
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT pp.id FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pt.barcode = $1 LIMIT 1`, barcode,
+ ).Scan(&productID)
+ }
+
+ // Step 3: For UPC-A (12 digits), try converting to EAN-13 by prepending '0'
+ if productID == 0 && len(barcode) == 12 && isNumeric(barcode) {
+ ean13 := "0" + barcode
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM product_product WHERE barcode = $1 LIMIT 1`, ean13,
+ ).Scan(&productID)
+ // Also try the reverse: if stored as UPC but scanned as EAN
+ if productID == 0 {
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT pp.id FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pt.barcode = $1 LIMIT 1`, ean13,
+ ).Scan(&productID)
+ }
+ }
+
+ // Step 4: For EAN-13 (13 digits starting with 0), try stripping leading 0 to get UPC-A
+ if productID == 0 && len(barcode) == 13 && barcode[0] == '0' && isNumeric(barcode) {
+ upc := barcode[1:]
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM product_product WHERE barcode = $1 LIMIT 1`, upc,
+ ).Scan(&productID)
+ if productID == 0 {
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT pp.id FROM product_product pp
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ WHERE pt.barcode = $1 LIMIT 1`, upc,
+ ).Scan(&productID)
+ }
+ }
+
+ // Step 5: Try lot/serial number
+ if productID == 0 {
+ var lotProductID int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT product_id FROM stock_lot WHERE name = $1 LIMIT 1`, barcode,
+ ).Scan(&lotProductID)
+ productID = lotProductID
+ }
+
+ if productID == 0 {
+ return map[string]interface{}{
+ "found": false,
+ "barcode": barcode,
+ "message": fmt.Sprintf("No product found for barcode %q (tried UPC/EAN lookup)", barcode),
+ }, nil
+ }
+
+ // Step 6: Find matching move line in the picking
+ var moveLineID int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT sml.id FROM stock_move_line sml
+ JOIN stock_move sm ON sm.id = sml.move_id
+ WHERE sm.picking_id = $1 AND sml.product_id = $2 AND sm.state NOT IN ('done', 'cancel')
+ ORDER BY sml.id LIMIT 1`,
+ pickingID, productID,
+ ).Scan(&moveLineID)
+
+ if err != nil || moveLineID == 0 {
+ // Check if product expected in any move
+ var moveID int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM stock_move WHERE picking_id = $1 AND product_id = $2 AND state NOT IN ('done', 'cancel') LIMIT 1`,
+ pickingID, productID,
+ ).Scan(&moveID)
+
+ if moveID == 0 {
+ return map[string]interface{}{
+ "found": false,
+ "product_id": productID,
+ "message": fmt.Sprintf("Product %d not expected in this transfer", productID),
+ }, nil
+ }
+
+ return map[string]interface{}{
+ "found": true,
+ "product_id": productID,
+ "move_id": moveID,
+ "action": "new_line",
+ "message": "Product found in move, new line needed",
+ }, nil
+ }
+
+ // Increment quantity on the move line
+ _, err = env.Tx().Exec(env.Ctx(),
+ `UPDATE stock_move_line SET quantity = quantity + 1 WHERE id = $1`, moveLineID)
+ if err != nil {
+ return nil, fmt.Errorf("stock.barcode.picking: increment qty on move line %d: %w", moveLineID, err)
+ }
+
+ return map[string]interface{}{
+ "found": true,
+ "product_id": productID,
+ "move_line_id": moveLineID,
+ "action": "incremented",
+ "message": "Quantity incremented",
+ }, nil
+ })
+
// process_barcode_picking: Process a barcode in the context of a picking.
// Finds the product and increments qty_done on the matching move line.
// Mirrors: stock_barcode.picking barcode processing
@@ -234,3 +365,13 @@ func initStockBarcode() {
}, nil
})
}
+
+// isNumeric checks if a string contains only digit characters.
+func isNumeric(s string) bool {
+ for _, c := range s {
+ if c < '0' || c > '9' {
+ return false
+ }
+ }
+ return len(s) > 0
+}
diff --git a/addons/stock/models/stock_landed_cost.go b/addons/stock/models/stock_landed_cost.go
index 42e2011..94cd283 100644
--- a/addons/stock/models/stock_landed_cost.go
+++ b/addons/stock/models/stock_landed_cost.go
@@ -2,7 +2,6 @@ package models
import (
"fmt"
- "math"
"odoo-go/pkg/orm"
)
@@ -221,8 +220,11 @@ func initStockLandedCost() {
_, err := env.Tx().Exec(env.Ctx(),
`UPDATE stock_valuation_layer
SET remaining_value = remaining_value + $1, value = value + $1
- WHERE stock_move_id = $2 AND product_id = $3 AND remaining_qty > 0
- LIMIT 1`,
+ WHERE id = (
+ SELECT id FROM stock_valuation_layer
+ WHERE stock_move_id = $2 AND product_id = $3 AND remaining_qty > 0
+ ORDER BY id LIMIT 1
+ )`,
adj.AdditionalCost, adj.MoveID, adj.ProductID,
)
if err != nil {
@@ -375,8 +377,3 @@ func initStockLandedCost() {
orm.Many2one("currency_id", "res.currency", orm.FieldOpts{String: "Currency"}),
)
}
-
-// roundCurrency rounds a monetary value to 2 decimal places.
-func roundCurrency(value float64) float64 {
- return math.Round(value*100) / 100
-}
diff --git a/addons/stock/models/stock_report.go b/addons/stock/models/stock_report.go
index 10c7f07..715b557 100644
--- a/addons/stock/models/stock_report.go
+++ b/addons/stock/models/stock_report.go
@@ -513,3 +513,234 @@ func initStockForecast() {
return map[string]interface{}{"products": products}, nil
})
}
+
+// initStockIntrastat registers stock.intrastat.line β Intrastat reporting model for
+// EU cross-border trade declarations. Tracks move-level trade data.
+// Mirrors: odoo/addons/stock_intrastat/models/stock_intrastat.py
+func initStockIntrastat() {
+ m := orm.NewModel("stock.intrastat.line", orm.ModelOpts{
+ Description: "Intrastat Line",
+ Order: "id desc",
+ })
+ m.AddFields(
+ orm.Many2one("move_id", "stock.move", orm.FieldOpts{
+ String: "Stock Move", Required: true, Index: true, OnDelete: orm.OnDeleteCascade,
+ }),
+ orm.Many2one("product_id", "product.product", orm.FieldOpts{
+ String: "Product", Required: true, Index: true,
+ }),
+ orm.Many2one("country_id", "res.country", orm.FieldOpts{
+ String: "Country", Required: true, Index: true,
+ }),
+ orm.Float("weight", orm.FieldOpts{String: "Weight (kg)", Required: true}),
+ orm.Monetary("value", orm.FieldOpts{String: "Fiscal Value", CurrencyField: "currency_id", Required: true}),
+ orm.Many2one("currency_id", "res.currency", orm.FieldOpts{String: "Currency"}),
+ orm.Selection("transaction_type", []orm.SelectionItem{
+ {Value: "arrival", Label: "Arrival"},
+ {Value: "dispatch", Label: "Dispatch"},
+ }, orm.FieldOpts{String: "Transaction Type", Required: true, Index: true}),
+ orm.Char("intrastat_code", orm.FieldOpts{String: "Commodity Code"}),
+ orm.Many2one("company_id", "res.company", orm.FieldOpts{String: "Company", Index: true}),
+ orm.Date("date", orm.FieldOpts{String: "Date", Index: true}),
+ orm.Char("transport_mode", orm.FieldOpts{String: "Transport Mode"}),
+ )
+
+ // generate_lines: Auto-generate Intrastat lines from done stock moves in a date range.
+ // Args: date_from (string), date_to (string), optional company_id (int64)
+ // Mirrors: stock.intrastat.report generation
+ m.RegisterMethod("generate_lines", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 2 {
+ return nil, fmt.Errorf("stock.intrastat.line.generate_lines requires date_from, date_to")
+ }
+ dateFrom, _ := args[0].(string)
+ dateTo, _ := args[1].(string)
+ if dateFrom == "" || dateTo == "" {
+ return nil, fmt.Errorf("stock.intrastat.line: invalid date range")
+ }
+
+ companyID := int64(1)
+ if len(args) >= 3 {
+ if cid, ok := args[2].(int64); ok && cid > 0 {
+ companyID = cid
+ }
+ }
+
+ env := rs.Env()
+
+ // Find done moves crossing borders (source or dest is in a different country)
+ // For simplicity, look for moves between locations belonging to different warehouses
+ // or between internal and non-internal locations.
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT sm.id, sm.product_id, sm.product_uom_qty, sm.price_unit, sm.date,
+ sl_src.usage as src_usage, sl_dst.usage as dst_usage,
+ COALESCE(rp.country_id, 0) as partner_country_id
+ FROM stock_move sm
+ JOIN stock_location sl_src ON sl_src.id = sm.location_id
+ JOIN stock_location sl_dst ON sl_dst.id = sm.location_dest_id
+ LEFT JOIN stock_picking sp ON sp.id = sm.picking_id
+ LEFT JOIN res_partner rp ON rp.id = sp.partner_id
+ WHERE sm.state = 'done'
+ AND sm.date >= $1 AND sm.date <= $2
+ AND sm.company_id = $3
+ AND (
+ (sl_src.usage = 'supplier' AND sl_dst.usage = 'internal')
+ OR (sl_src.usage = 'internal' AND sl_dst.usage = 'customer')
+ )
+ ORDER BY sm.date`,
+ dateFrom, dateTo, companyID,
+ )
+ if err != nil {
+ return nil, fmt.Errorf("stock.intrastat.line: query moves: %w", err)
+ }
+
+ type moveData struct {
+ MoveID, ProductID int64
+ Qty, PriceUnit float64
+ Date *string
+ SrcUsage string
+ DstUsage string
+ CountryID int64
+ }
+ var moves []moveData
+ for rows.Next() {
+ var md moveData
+ if err := rows.Scan(&md.MoveID, &md.ProductID, &md.Qty, &md.PriceUnit,
+ &md.Date, &md.SrcUsage, &md.DstUsage, &md.CountryID); err != nil {
+ rows.Close()
+ return nil, fmt.Errorf("stock.intrastat.line: scan move: %w", err)
+ }
+ moves = append(moves, md)
+ }
+ rows.Close()
+
+ var created int
+ for _, md := range moves {
+ // Determine transaction type
+ txnType := "arrival"
+ if md.SrcUsage == "internal" && md.DstUsage == "customer" {
+ txnType = "dispatch"
+ }
+
+ // Use partner country; skip if no country (can't determine border crossing)
+ countryID := md.CountryID
+ if countryID == 0 {
+ continue
+ }
+
+ // Compute value and weight
+ value := md.Qty * md.PriceUnit
+ weight := md.Qty // Simplified: weight = qty (would use product.weight in full impl)
+
+ dateStr := ""
+ if md.Date != nil {
+ dateStr = *md.Date
+ }
+
+ // Check if line already exists for this move
+ var existing int64
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM stock_intrastat_line WHERE move_id = $1 LIMIT 1`, md.MoveID,
+ ).Scan(&existing)
+ if existing > 0 {
+ continue
+ }
+
+ _, err := env.Tx().Exec(env.Ctx(),
+ `INSERT INTO stock_intrastat_line
+ (move_id, product_id, country_id, weight, value, transaction_type, company_id, date)
+ VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+ md.MoveID, md.ProductID, countryID, weight, value, txnType, companyID, dateStr,
+ )
+ if err != nil {
+ return nil, fmt.Errorf("stock.intrastat.line: create line for move %d: %w", md.MoveID, err)
+ }
+ created++
+ }
+
+ return map[string]interface{}{
+ "created": created,
+ "date_from": dateFrom,
+ "date_to": dateTo,
+ }, nil
+ })
+
+ // get_report: Return Intrastat report data for a period.
+ // Args: date_from (string), date_to (string), optional transaction_type (string)
+ // Mirrors: stock.intrastat.report views
+ m.RegisterMethod("get_report", func(rs *orm.Recordset, args ...interface{}) (interface{}, error) {
+ if len(args) < 2 {
+ return nil, fmt.Errorf("stock.intrastat.line.get_report requires date_from, date_to")
+ }
+ dateFrom, _ := args[0].(string)
+ dateTo, _ := args[1].(string)
+
+ var txnTypeFilter string
+ if len(args) >= 3 {
+ txnTypeFilter, _ = args[2].(string)
+ }
+
+ env := rs.Env()
+
+ query := `SELECT sil.id, sil.move_id, sil.product_id, pt.name as product_name,
+ sil.country_id, COALESCE(rc.name, '') as country_name,
+ sil.weight, sil.value, sil.transaction_type,
+ COALESCE(sil.intrastat_code, '') as commodity_code,
+ sil.date
+ FROM stock_intrastat_line sil
+ JOIN product_product pp ON pp.id = sil.product_id
+ JOIN product_template pt ON pt.id = pp.product_tmpl_id
+ LEFT JOIN res_country rc ON rc.id = sil.country_id
+ WHERE sil.date >= $1 AND sil.date <= $2`
+
+ queryArgs := []interface{}{dateFrom, dateTo}
+
+ if txnTypeFilter != "" {
+ query += ` AND sil.transaction_type = $3`
+ queryArgs = append(queryArgs, txnTypeFilter)
+ }
+ query += ` ORDER BY sil.date, sil.id`
+
+ rows, err := env.Tx().Query(env.Ctx(), query, queryArgs...)
+ if err != nil {
+ return nil, fmt.Errorf("stock.intrastat.line: query report: %w", err)
+ }
+ defer rows.Close()
+
+ var lines []map[string]interface{}
+ var totalWeight, totalValue float64
+ for rows.Next() {
+ var lineID, moveID, productID, countryID int64
+ var productName, countryName, txnType, commodityCode string
+ var weight, value float64
+ var date *string
+ if err := rows.Scan(&lineID, &moveID, &productID, &productName,
+ &countryID, &countryName, &weight, &value, &txnType,
+ &commodityCode, &date); err != nil {
+ return nil, fmt.Errorf("stock.intrastat.line: scan report row: %w", err)
+ }
+ dateStr := ""
+ if date != nil {
+ dateStr = *date
+ }
+ lines = append(lines, map[string]interface{}{
+ "id": lineID, "move_id": moveID,
+ "product_id": productID, "product": productName,
+ "country_id": countryID, "country": countryName,
+ "weight": weight, "value": value,
+ "transaction_type": txnType,
+ "commodity_code": commodityCode,
+ "date": dateStr,
+ })
+ totalWeight += weight
+ totalValue += value
+ }
+
+ return map[string]interface{}{
+ "lines": lines,
+ "total_weight": totalWeight,
+ "total_value": totalValue,
+ "date_from": dateFrom,
+ "date_to": dateTo,
+ }, nil
+ })
+}
diff --git a/addons/stock/models/stock_valuation.go b/addons/stock/models/stock_valuation.go
index 2459b67..dc97b37 100644
--- a/addons/stock/models/stock_valuation.go
+++ b/addons/stock/models/stock_valuation.go
@@ -127,13 +127,22 @@ func initStockValuationLayer() {
}
defer rows.Close()
- var totalConsumedValue float64
+ // Collect layers first, then close cursor before updating (pgx safety)
+ type layerConsumption struct {
+ id int64
+ newQty float64
+ newValue float64
+ consumed float64
+ cost float64
+ }
+ var consumptions []layerConsumption
remaining := qtyToConsume
for rows.Next() && remaining > 0 {
var layerID int64
var layerQty, layerValue, layerUnitCost float64
if err := rows.Scan(&layerID, &layerQty, &layerValue, &layerUnitCost); err != nil {
+ rows.Close()
return nil, fmt.Errorf("stock.valuation.layer: scan FIFO layer: %w", err)
}
@@ -142,20 +151,27 @@ func initStockValuationLayer() {
consumed = layerQty
}
- consumedValue := consumed * layerUnitCost
- newRemainingQty := layerQty - consumed
- newRemainingValue := layerValue - consumedValue
+ consumptions = append(consumptions, layerConsumption{
+ id: layerID,
+ newQty: layerQty - consumed,
+ newValue: layerValue - consumed*layerUnitCost,
+ consumed: consumed,
+ cost: layerUnitCost,
+ })
+ remaining -= consumed
+ }
+ rows.Close()
+ // Now update layers outside the cursor
+ var totalConsumedValue float64
+ for _, c := range consumptions {
_, err := env.Tx().Exec(env.Ctx(),
`UPDATE stock_valuation_layer SET remaining_qty = $1, remaining_value = $2 WHERE id = $3`,
- newRemainingQty, newRemainingValue, layerID,
- )
+ c.newQty, c.newValue, c.id)
if err != nil {
- return nil, fmt.Errorf("stock.valuation.layer: update layer %d: %w", layerID, err)
+ return nil, fmt.Errorf("stock.valuation.layer: update layer %d: %w", c.id, err)
}
-
- totalConsumedValue += consumedValue
- remaining -= consumed
+ totalConsumedValue += c.consumed * c.cost
}
return map[string]interface{}{
diff --git a/cmd/odoo-server/main.go b/cmd/odoo-server/main.go
index fd13136..7255c2c 100644
--- a/cmd/odoo-server/main.go
+++ b/cmd/odoo-server/main.go
@@ -19,6 +19,7 @@ import (
// Import all modules (register models via init())
_ "odoo-go/addons/base"
+ _ "odoo-go/addons/mail"
_ "odoo-go/addons/account"
_ "odoo-go/addons/product"
_ "odoo-go/addons/sale"
@@ -126,6 +127,11 @@ func main() {
log.Printf("odoo: session table init warning: %v", err)
}
+ // Start cron scheduler
+ cronScheduler := service.NewCronScheduler(pool)
+ cronScheduler.Start()
+ defer cronScheduler.Stop()
+
// Start HTTP server
srv := server.New(cfg, pool)
log.Printf("odoo: starting HTTP service on %s:%d", cfg.HTTPInterface, cfg.HTTPPort)
diff --git a/go.mod b/go.mod
index bb694a2..b61bf60 100644
--- a/go.mod
+++ b/go.mod
@@ -1,14 +1,24 @@
module odoo-go
-go 1.22.2
+go 1.24.0
require github.com/jackc/pgx/v5 v5.7.4
require (
+ github.com/emersion/go-imap/v2 v2.0.0-beta.8 // indirect
+ github.com/emersion/go-message v0.18.2 // indirect
+ github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
- golang.org/x/crypto v0.31.0 // indirect
- golang.org/x/sync v0.10.0 // indirect
- golang.org/x/text v0.21.0 // indirect
+ github.com/richardlehane/mscfb v1.0.6 // indirect
+ github.com/richardlehane/msoleps v1.0.6 // indirect
+ github.com/tiendc/go-deepcopy v1.7.2 // indirect
+ github.com/xuri/efp v0.0.1 // indirect
+ github.com/xuri/excelize/v2 v2.10.1 // indirect
+ github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 // indirect
+ golang.org/x/crypto v0.48.0 // indirect
+ golang.org/x/net v0.50.0 // indirect
+ golang.org/x/sync v0.19.0 // indirect
+ golang.org/x/text v0.34.0 // indirect
)
diff --git a/go.sum b/go.sum
index fa0f7db..b292925 100644
--- a/go.sum
+++ b/go.sum
@@ -1,6 +1,12 @@
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emersion/go-imap/v2 v2.0.0-beta.8 h1:5IXZK1E33DyeP526320J3RS7eFlCYGFgtbrfapqDPug=
+github.com/emersion/go-imap/v2 v2.0.0-beta.8/go.mod h1:dhoFe2Q0PwLrMD7oZw8ODuaD0vLYPe5uj2wcOMnvh48=
+github.com/emersion/go-message v0.18.2 h1:rl55SQdjd9oJcIoQNhubD2Acs1E6IzlZISRTK7x/Lpg=
+github.com/emersion/go-message v0.18.2/go.mod h1:XpJyL70LwRvq2a8rVbHXikPgKj8+aI0kGdHlg16ibYA=
+github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 h1:oP4q0fw+fOSWn3DfFi4EXdT+B+gTtzx8GC9xsc26Znk=
+github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
@@ -11,17 +17,69 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/richardlehane/mscfb v1.0.6 h1:eN3bvvZCp00bs7Zf52bxNwAx5lJDBK1tCuH19qq5aC8=
+github.com/richardlehane/mscfb v1.0.6/go.mod h1:pe0+IUIc0AHh0+teNzBlJCtSyZdFOGgV4ZK9bsoV+Jo=
+github.com/richardlehane/msoleps v1.0.6 h1:9BvkpjvD+iUBalUY4esMwv6uBkfOip/Lzvd93jvR9gg=
+github.com/richardlehane/msoleps v1.0.6/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/tiendc/go-deepcopy v1.7.2 h1:Ut2yYR7W9tWjTQitganoIue4UGxZwCcJy3orjrrIj44=
+github.com/tiendc/go-deepcopy v1.7.2/go.mod h1:4bKjNC2r7boYOkD2IOuZpYjmlDdzjbpTRyCx+goBCJQ=
+github.com/xuri/efp v0.0.1 h1:fws5Rv3myXyYni8uwj2qKjVaRP30PdjeYe2Y6FDsCL8=
+github.com/xuri/efp v0.0.1/go.mod h1:ybY/Jr0T0GTCnYjKqmdwxyxn2BQf2RcQIIvex5QldPI=
+github.com/xuri/excelize/v2 v2.10.1 h1:V62UlqopMqha3kOpnlHy2CcRVw1V8E63jFoWUmMzxN0=
+github.com/xuri/excelize/v2 v2.10.1/go.mod h1:iG5tARpgaEeIhTqt3/fgXCGoBRt4hNXgCp3tfXKoOIc=
+github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 h1:+C0TIdyyYmzadGaL/HBLbf3WdLgC29pgyhTjAT/0nuE=
+github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/odoo-server b/odoo-server
index ad8f4eb..75e155b 100755
Binary files a/odoo-server and b/odoo-server differ
diff --git a/open.md b/open.md
new file mode 100644
index 0000000..2902628
--- /dev/null
+++ b/open.md
@@ -0,0 +1,25 @@
+# Offene Punkte
+
+> Stand: 2026-04-12
+> Business-Module: alle auf 95% β KOMPLETT
+> Odoo Community Core: Portal + Email Inbound + Discuss β KOMPLETT
+
+---
+
+## Odoo Community Core β KOMPLETT
+
+- [x] **Portal** β Portal-User (share=true), /my/* Routes, Signup, Password Reset β
2026-04-12
+- [x] **Email Inbound** β IMAP Polling (go-imap/v2), Email Parser, Thread Matching β
2026-04-12
+- [x] **Discuss** β mail.channel + mail.channel.member, Long-Polling Bus, DM, Channel CRUD, Unread Count β
2026-04-12
+
+---
+
+## Frontend / UI Zukunft β 2 Items (langfristig)
+
+| # | Was |
+|---|-----|
+| 1 | UI modernisieren β schrittweise schneller, stabiler, optisch erneuern |
+| 2 | View-Format β langfristig format-agnostisch (JSON-fΓ€hig), weg von XML wo mΓΆglich |
+
+
+
diff --git a/pkg/orm/compute.go b/pkg/orm/compute.go
index 09d116c..d933f72 100644
--- a/pkg/orm/compute.go
+++ b/pkg/orm/compute.go
@@ -1,6 +1,9 @@
package orm
-import "fmt"
+import (
+ "fmt"
+ "log"
+)
// ComputeFunc is a function that computes field values for a recordset.
// Mirrors: @api.depends decorated methods in Odoo.
@@ -253,7 +256,7 @@ func RunOnchangeComputes(m *Model, env *Environment, currentVals Values, changed
computed, err := fn(rs)
if err != nil {
- // Non-fatal: skip failed computes during onchange
+ log.Printf("orm: onchange compute %s.%s failed: %v", m.Name(), fieldName, err)
continue
}
for k, v := range computed {
diff --git a/pkg/orm/domain.go b/pkg/orm/domain.go
index ae24c67..358fce7 100644
--- a/pkg/orm/domain.go
+++ b/pkg/orm/domain.go
@@ -2,6 +2,8 @@ package orm
import (
"fmt"
+ "regexp"
+ "strconv"
"strings"
)
@@ -152,6 +154,8 @@ func (dc *DomainCompiler) JoinSQL() string {
return " " + strings.Join(parts, " ")
}
+// compileNodes compiles domain nodes in Polish (prefix) notation.
+// Returns the SQL string and the number of nodes consumed from the domain starting at pos.
func (dc *DomainCompiler) compileNodes(domain Domain, pos int) (string, error) {
if pos >= len(domain) {
return "TRUE", nil
@@ -167,7 +171,8 @@ func (dc *DomainCompiler) compileNodes(domain Domain, pos int) (string, error) {
if err != nil {
return "", err
}
- right, err := dc.compileNodes(domain, pos+2)
+ leftSize := nodeSize(domain, pos+1)
+ right, err := dc.compileNodes(domain, pos+1+leftSize)
if err != nil {
return "", err
}
@@ -178,7 +183,8 @@ func (dc *DomainCompiler) compileNodes(domain Domain, pos int) (string, error) {
if err != nil {
return "", err
}
- right, err := dc.compileNodes(domain, pos+2)
+ leftSize := nodeSize(domain, pos+1)
+ right, err := dc.compileNodes(domain, pos+1+leftSize)
if err != nil {
return "", err
}
@@ -196,8 +202,6 @@ func (dc *DomainCompiler) compileNodes(domain Domain, pos int) (string, error) {
return dc.compileCondition(n)
case domainGroup:
- // domainGroup wraps a sub-domain as a single node.
- // Compile it recursively as a full domain.
subSQL, _, err := dc.compileDomainGroup(Domain(n))
if err != nil {
return "", err
@@ -208,6 +212,28 @@ func (dc *DomainCompiler) compileNodes(domain Domain, pos int) (string, error) {
return "", fmt.Errorf("unexpected domain node at position %d: %v", pos, node)
}
+// nodeSize returns the number of domain nodes consumed by the subtree at pos.
+// Operators (&, |) consume 1 + left subtree + right subtree.
+// NOT consumes 1 + inner subtree. Leaf nodes consume 1.
+func nodeSize(domain Domain, pos int) int {
+ if pos >= len(domain) {
+ return 0
+ }
+ switch n := domain[pos].(type) {
+ case Operator:
+ _ = n
+ switch domain[pos].(Operator) {
+ case OpAnd, OpOr:
+ leftSize := nodeSize(domain, pos+1)
+ rightSize := nodeSize(domain, pos+1+leftSize)
+ return 1 + leftSize + rightSize
+ case OpNot:
+ return 1 + nodeSize(domain, pos+1)
+ }
+ }
+ return 1 // Condition or domainGroup = 1 node
+}
+
// compileDomainGroup compiles a sub-domain that was wrapped via domainGroup.
// It reuses the same DomainCompiler (sharing params and joins) so parameter
// indices stay consistent with the outer query.
@@ -227,14 +253,12 @@ func (dc *DomainCompiler) compileCondition(c Condition) (string, error) {
return "", fmt.Errorf("invalid operator: %q", c.Operator)
}
- // Handle dot notation (e.g., "partner_id.name")
+ // Handle dot notation (e.g., "partner_id.name", "partner_id.country_id.code")
+ // by generating LEFT JOINs through the M2O relational chain.
parts := strings.Split(c.Field, ".")
column := parts[0]
- // TODO: Handle JOINs for dot notation paths
- // For now, only support direct fields
if len(parts) > 1 {
- // Placeholder for JOIN resolution
return dc.compileJoinedCondition(parts, c.Operator, c.Value)
}
@@ -285,7 +309,7 @@ func (dc *DomainCompiler) compileJoinedCondition(fieldPath []string, operator st
dc.joins = append(dc.joins, joinClause{
table: comodel.Table(),
alias: alias,
- on: fmt.Sprintf("%s.%q = %q.\"id\"", currentAlias, f.Column(), alias),
+ on: fmt.Sprintf("%q.%q = %q.\"id\"", currentAlias, f.Column(), alias),
})
currentModel = comodel
@@ -293,8 +317,12 @@ func (dc *DomainCompiler) compileJoinedCondition(fieldPath []string, operator st
}
// The last segment is the actual field to filter on
- leafField := fieldPath[len(fieldPath)-1]
- qualifiedColumn := fmt.Sprintf("%s.%q", currentAlias, leafField)
+ leafFieldName := fieldPath[len(fieldPath)-1]
+ leafCol := leafFieldName
+ if lf := currentModel.GetField(leafFieldName); lf != nil {
+ leafCol = lf.Column()
+ }
+ qualifiedColumn := fmt.Sprintf("%q.%q", currentAlias, leafCol)
return dc.compileQualifiedCondition(qualifiedColumn, operator, value)
}
@@ -528,13 +556,8 @@ func (dc *DomainCompiler) compileAnyOp(column string, value Value, negate bool)
// Rebase parameter indices: shift them by the current param count
baseIdx := len(dc.params)
dc.params = append(dc.params, subParams...)
- rebased := subWhere
- // Replace $N with $(N+baseIdx) in the sub-where clause
- for i := len(subParams); i >= 1; i-- {
- old := fmt.Sprintf("$%d", i)
- new := fmt.Sprintf("$%d", i+baseIdx)
- rebased = strings.ReplaceAll(rebased, old, new)
- }
+ // Replace $N with $(N+baseIdx) using regex to avoid $1 matching $10
+ rebased := rebaseParams(subWhere, baseIdx)
// Determine the join condition based on field type
var joinCond string
@@ -676,3 +699,14 @@ func wrapLikeValue(value Value) Value {
}
return "%" + s + "%"
}
+
+// rebaseParams shifts $N placeholders in a SQL string by baseIdx.
+// Uses regex to avoid $1 matching inside $10.
+var paramRegex = regexp.MustCompile(`\$(\d+)`)
+
+func rebaseParams(sql string, baseIdx int) string {
+ return paramRegex.ReplaceAllStringFunc(sql, func(match string) string {
+ n, _ := strconv.Atoi(match[1:])
+ return fmt.Sprintf("$%d", n+baseIdx)
+ })
+}
diff --git a/pkg/orm/model.go b/pkg/orm/model.go
index b6d2818..fe3b0fc 100644
--- a/pkg/orm/model.go
+++ b/pkg/orm/model.go
@@ -45,8 +45,9 @@ type Model struct {
checkCompany bool // Enforce multi-company record rules
// Hooks
- BeforeCreate func(env *Environment, vals Values) error // Called before INSERT
- DefaultGet func(env *Environment, fields []string) Values // Dynamic defaults (e.g., from DB)
+ BeforeCreate func(env *Environment, vals Values) error // Called before INSERT
+ BeforeWrite func(env *Environment, ids []int64, vals Values) error // Called before UPDATE β for state guards
+ DefaultGet func(env *Environment, fields []string) Values // Dynamic defaults (e.g., from DB)
Constraints []ConstraintFunc // Validation constraints
Methods map[string]MethodFunc // Named business methods
@@ -453,3 +454,32 @@ func (m *Model) Many2manyTableSQL() []string {
}
return stmts
}
+
+// StateGuard returns a BeforeWrite function that prevents modifications on records
+// in certain states, except for explicitly allowed fields.
+// Eliminates the duplicated guard pattern across sale.order, purchase.order,
+// account.move, and stock.picking.
+func StateGuard(table, stateCondition string, allowedFields []string, errMsg string) func(env *Environment, ids []int64, vals Values) error {
+ allowed := make(map[string]bool, len(allowedFields))
+ for _, f := range allowedFields {
+ allowed[f] = true
+ }
+ return func(env *Environment, ids []int64, vals Values) error {
+ if _, changingState := vals["state"]; changingState {
+ return nil
+ }
+ var count int
+ err := env.Tx().QueryRow(env.Ctx(),
+ fmt.Sprintf(`SELECT COUNT(*) FROM %s WHERE id = ANY($1) AND %s`, table, stateCondition), ids,
+ ).Scan(&count)
+ if err != nil || count == 0 {
+ return nil
+ }
+ for field := range vals {
+ if !allowed[field] {
+ return fmt.Errorf("%s: %s", table, errMsg)
+ }
+ }
+ return nil
+ }
+}
diff --git a/pkg/orm/read_group.go b/pkg/orm/read_group.go
index 3a78c6c..6b9d58e 100644
--- a/pkg/orm/read_group.go
+++ b/pkg/orm/read_group.go
@@ -153,7 +153,7 @@ func (rs *Recordset) ReadGroup(domain Domain, groupby []string, aggregates []str
// Build ORDER BY
orderSQL := ""
if opt.Order != "" {
- orderSQL = opt.Order
+ orderSQL = sanitizeOrderBy(opt.Order, m)
} else if len(gbCols) > 0 {
// Default: order by groupby columns
var orderParts []string
diff --git a/pkg/orm/recordset.go b/pkg/orm/recordset.go
index fe5e3f2..888b080 100644
--- a/pkg/orm/recordset.go
+++ b/pkg/orm/recordset.go
@@ -2,6 +2,7 @@ package orm
import (
"fmt"
+ "log"
"strings"
)
@@ -265,18 +266,28 @@ func preprocessRelatedWrites(env *Environment, m *Model, ids []int64, vals Value
value := vals[fieldName]
delete(vals, fieldName) // Remove from vals β no local column
- // Read FK IDs for all records
+ // Read FK IDs for all records in a single query
var fkIDs []int64
- for _, id := range ids {
- var fkID *int64
- env.tx.QueryRow(env.ctx,
- fmt.Sprintf(`SELECT %q FROM %q WHERE id = $1`, fkDef.Column(), m.Table()),
- id,
- ).Scan(&fkID)
- if fkID != nil && *fkID > 0 {
- fkIDs = append(fkIDs, *fkID)
+ rows, err := env.tx.Query(env.ctx,
+ fmt.Sprintf(`SELECT %q FROM %q WHERE id = ANY($1) AND %q IS NOT NULL`,
+ fkDef.Column(), m.Table(), fkDef.Column()),
+ ids,
+ )
+ if err != nil {
+ delete(vals, fieldName)
+ continue
+ }
+ for rows.Next() {
+ var fkID int64
+ if err := rows.Scan(&fkID); err != nil {
+ log.Printf("orm: preprocessRelatedWrites scan error on %s.%s: %v", m.Name(), fieldName, err)
+ continue
+ }
+ if fkID > 0 {
+ fkIDs = append(fkIDs, fkID)
}
}
+ rows.Close()
if len(fkIDs) == 0 {
continue
@@ -315,6 +326,13 @@ func (rs *Recordset) Write(vals Values) error {
m := rs.model
+ // BeforeWrite hook β state guards, locked record checks etc.
+ if m.BeforeWrite != nil {
+ if err := m.BeforeWrite(rs.env, rs.ids, vals); err != nil {
+ return err
+ }
+ }
+
var setClauses []string
var args []interface{}
idx := 1
@@ -787,7 +805,7 @@ func (rs *Recordset) Search(domain Domain, opts ...SearchOpts) (*Recordset, erro
// Build query
order := m.order
if opt.Order != "" {
- order = opt.Order
+ order = sanitizeOrderBy(opt.Order, m)
}
joinSQL := compiler.JoinSQL()
@@ -1103,6 +1121,72 @@ func toRecordID(v interface{}) (int64, bool) {
return 0, false
}
+// sanitizeOrderBy validates an ORDER BY clause to prevent SQL injection.
+// Only allows: field names (alphanumeric + underscore), ASC/DESC, NULLS FIRST/LAST, commas.
+// Returns sanitized string or fallback to "id" if invalid.
+func sanitizeOrderBy(order string, m *Model) string {
+ if order == "" {
+ return "id"
+ }
+ parts := strings.Split(order, ",")
+ var safe []string
+ for _, part := range parts {
+ part = strings.TrimSpace(part)
+ if part == "" {
+ continue
+ }
+ tokens := strings.Fields(part)
+ if len(tokens) == 0 {
+ continue
+ }
+ // First token must be a valid field name or "table"."field"
+ col := tokens[0]
+ // Strip quotes for validation
+ cleanCol := strings.ReplaceAll(strings.ReplaceAll(col, "\"", ""), "'", "")
+ // Allow dot notation (table.field) but validate each part
+ colParts := strings.Split(cleanCol, ".")
+ valid := true
+ for _, cp := range colParts {
+ if !isValidIdentifier(cp) {
+ valid = false
+ break
+ }
+ }
+ if !valid {
+ continue // Skip this part entirely
+ }
+ // Remaining tokens must be ASC, DESC, NULLS, FIRST, LAST
+ safePart := col
+ for _, tok := range tokens[1:] {
+ upper := strings.ToUpper(tok)
+ switch upper {
+ case "ASC", "DESC", "NULLS", "FIRST", "LAST":
+ safePart += " " + upper
+ default:
+ // Invalid token β skip
+ }
+ }
+ safe = append(safe, safePart)
+ }
+ if len(safe) == 0 {
+ return "id"
+ }
+ return strings.Join(safe, ", ")
+}
+
+// isValidIdentifier checks if a string is a valid SQL identifier (letters, digits, underscore).
+func isValidIdentifier(s string) bool {
+ if s == "" {
+ return false
+ }
+ for _, c := range s {
+ if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '_') {
+ return false
+ }
+ }
+ return true
+}
+
// qualifyOrderBy prefixes unqualified column names with the table name.
// "name, id desc" β "\"my_table\".name, \"my_table\".id desc"
func qualifyOrderBy(table, order string) string {
diff --git a/pkg/orm/rules.go b/pkg/orm/rules.go
index 68d3c6c..5fb43b8 100644
--- a/pkg/orm/rules.go
+++ b/pkg/orm/rules.go
@@ -70,8 +70,9 @@ func ApplyRecordRules(env *Environment, m *Model, domain Domain) Domain {
ORDER BY r.id`,
m.Name(), env.UID())
if err != nil {
+ log.Printf("orm: ir.rule query failed for %s: %v β denying access", m.Name(), err)
sp.Rollback(env.ctx)
- return domain
+ return append(domain, Leaf("id", "=", -1)) // Deny all β no records match id=-1
}
type ruleRow struct {
@@ -207,7 +208,8 @@ func CheckRecordRuleAccess(env *Environment, m *Model, ids []int64, perm string)
var count int64
err := env.tx.QueryRow(env.ctx, query, args...).Scan(&count)
if err != nil {
- return nil // Fail open on error
+ log.Printf("orm: record rule check failed for %s: %v", m.Name(), err)
+ return fmt.Errorf("orm: access denied on %s (record rule check failed)", m.Name())
}
if count < int64(len(ids)) {
diff --git a/pkg/server/action.go b/pkg/server/action.go
index 5771b20..8c5a66f 100644
--- a/pkg/server/action.go
+++ b/pkg/server/action.go
@@ -3,6 +3,7 @@ package server
import (
"encoding/json"
"fmt"
+ "log"
"net/http"
"strings"
)
@@ -145,10 +146,12 @@ func (s *Server) handleActionLoad(w http.ResponseWriter, r *http.Request) {
// Look up xml_id from ir_model_data
xmlID := ""
- _ = s.pool.QueryRow(ctx,
+ if err := s.pool.QueryRow(ctx,
`SELECT module || '.' || name FROM ir_model_data
WHERE model = 'ir.actions.act_window' AND res_id = $1
- LIMIT 1`, id).Scan(&xmlID)
+ LIMIT 1`, id).Scan(&xmlID); err != nil {
+ log.Printf("warning: action xml_id lookup failed for id=%d: %v", id, err)
+ }
// Build views array from view_mode string (e.g. "list,kanban,form" β [[nil,"list"],[nil,"kanban"],[nil,"form"]])
views := buildViewsFromMode(viewMode)
diff --git a/pkg/server/bank_import.go b/pkg/server/bank_import.go
new file mode 100644
index 0000000..5c4696f
--- /dev/null
+++ b/pkg/server/bank_import.go
@@ -0,0 +1,292 @@
+package server
+
+import (
+ "encoding/csv"
+ "encoding/json"
+ "fmt"
+ "io"
+ "log"
+ "net/http"
+ "strconv"
+ "strings"
+ "time"
+
+ "odoo-go/pkg/orm"
+)
+
+// handleBankStatementImport imports bank statement lines from CSV data.
+// Accepts JSON body with: journal_id, csv_data, column_mapping, has_header.
+// After import, optionally triggers auto-matching against open invoices.
+// Mirrors: odoo/addons/account/wizard/account_bank_statement_import.py
+func (s *Server) handleBankStatementImport(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+
+ var req JSONRPCRequest
+ if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+ s.writeJSONRPC(w, nil, nil, &RPCError{Code: -32700, Message: "Parse error"})
+ return
+ }
+
+ var params struct {
+ JournalID int64 `json:"journal_id"`
+ CSVData string `json:"csv_data"`
+ HasHeader bool `json:"has_header"`
+ ColumnMapping bankColumnMapping `json:"column_mapping"`
+ AutoMatch bool `json:"auto_match"`
+ }
+ if err := json.Unmarshal(req.Params, ¶ms); err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: "Invalid params"})
+ return
+ }
+
+ if params.JournalID == 0 || params.CSVData == "" {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: "journal_id and csv_data are required"})
+ return
+ }
+
+ uid := int64(1)
+ companyID := int64(1)
+ if sess := GetSession(r); sess != nil {
+ uid = sess.UID
+ companyID = sess.CompanyID
+ }
+
+ env, err := orm.NewEnvironment(r.Context(), orm.EnvConfig{
+ Pool: s.pool,
+ UID: uid,
+ CompanyID: companyID,
+ })
+ if err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32603, Message: "Internal error"})
+ return
+ }
+ defer env.Close()
+
+ // Parse CSV
+ reader := csv.NewReader(strings.NewReader(params.CSVData))
+ reader.LazyQuotes = true
+ reader.TrimLeadingSpace = true
+ // Try semicolon separator (common in European bank exports)
+ reader.Comma = detectDelimiter(params.CSVData)
+
+ var allRows [][]string
+ for {
+ row, err := reader.Read()
+ if err == io.EOF {
+ break
+ }
+ if err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: fmt.Sprintf("CSV parse error: %v", err)})
+ return
+ }
+ allRows = append(allRows, row)
+ }
+
+ dataRows := allRows
+ if params.HasHeader && len(allRows) > 1 {
+ dataRows = allRows[1:]
+ }
+
+ // Create a bank statement header
+ statementRS := env.Model("account.bank.statement")
+ stmt, err := statementRS.Create(orm.Values{
+ "name": fmt.Sprintf("Import %s", time.Now().Format("2006-01-02 15:04")),
+ "journal_id": params.JournalID,
+ "company_id": companyID,
+ "date": time.Now().Format("2006-01-02"),
+ })
+ if err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32603, Message: fmt.Sprintf("Create statement: %v", err)})
+ return
+ }
+ stmtID := stmt.ID()
+
+ // Default column mapping
+ cm := params.ColumnMapping
+ if cm.Date < 0 {
+ cm.Date = 0
+ }
+ if cm.Amount < 0 {
+ cm.Amount = 1
+ }
+ if cm.Label < 0 {
+ cm.Label = 2
+ }
+
+ // Import lines
+ lineRS := env.Model("account.bank.statement.line")
+ var importedIDs []int64
+ var errors []importError
+
+ for rowIdx, row := range dataRows {
+ // Parse date
+ dateStr := safeCol(row, cm.Date)
+ date := parseFlexDate(dateStr)
+ if date == "" {
+ date = time.Now().Format("2006-01-02")
+ }
+
+ // Parse amount
+ amountStr := safeCol(row, cm.Amount)
+ amount := parseAmount(amountStr)
+ if amount == 0 {
+ continue // skip zero-amount rows
+ }
+
+ // Parse label/reference
+ label := safeCol(row, cm.Label)
+ if label == "" {
+ label = fmt.Sprintf("Line %d", rowIdx+1)
+ }
+
+ // Parse optional columns
+ partnerName := safeCol(row, cm.PartnerName)
+ accountNumber := safeCol(row, cm.AccountNumber)
+
+ vals := orm.Values{
+ "statement_id": stmtID,
+ "journal_id": params.JournalID,
+ "company_id": companyID,
+ "date": date,
+ "amount": amount,
+ "payment_ref": label,
+ "partner_name": partnerName,
+ "account_number": accountNumber,
+ "sequence": rowIdx + 1,
+ }
+
+ rec, err := lineRS.Create(vals)
+ if err != nil {
+ errors = append(errors, importError{Row: rowIdx + 1, Message: err.Error()})
+ log.Printf("bank_import: row %d error: %v", rowIdx+1, err)
+ continue
+ }
+ importedIDs = append(importedIDs, rec.ID())
+ }
+
+ // Auto-match against open invoices
+ matchCount := 0
+ if params.AutoMatch && len(importedIDs) > 0 {
+ stLineModel := orm.Registry.Get("account.bank.statement.line")
+ if stLineModel != nil {
+ if matchMethod, ok := stLineModel.Methods["button_match"]; ok {
+ matchRS := env.Model("account.bank.statement.line").Browse(importedIDs...)
+ if _, err := matchMethod(matchRS); err != nil {
+ log.Printf("bank_import: auto-match error: %v", err)
+ }
+ }
+ }
+ // Count how many were matched
+ env.Tx().QueryRow(env.Ctx(),
+ `SELECT COUNT(*) FROM account_bank_statement_line WHERE id = ANY($1) AND is_reconciled = true`,
+ importedIDs).Scan(&matchCount)
+ }
+
+ if err := env.Commit(); err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32603, Message: fmt.Sprintf("Commit: %v", err)})
+ return
+ }
+
+ s.writeJSONRPC(w, req.ID, map[string]interface{}{
+ "statement_id": stmtID,
+ "imported": len(importedIDs),
+ "matched": matchCount,
+ "errors": errors,
+ }, nil)
+}
+
+// bankColumnMapping maps CSV columns to bank statement fields.
+type bankColumnMapping struct {
+ Date int `json:"date"` // column index for date
+ Amount int `json:"amount"` // column index for amount
+ Label int `json:"label"` // column index for label/reference
+ PartnerName int `json:"partner_name"` // column index for partner name (-1 = skip)
+ AccountNumber int `json:"account_number"` // column index for account number (-1 = skip)
+}
+
+// detectDelimiter guesses the CSV delimiter (comma, semicolon, or tab).
+func detectDelimiter(data string) rune {
+ firstLine := data
+ if idx := strings.IndexByte(data, '\n'); idx > 0 {
+ firstLine = data[:idx]
+ }
+ semicolons := strings.Count(firstLine, ";")
+ commas := strings.Count(firstLine, ",")
+ tabs := strings.Count(firstLine, "\t")
+
+ if semicolons > commas && semicolons > tabs {
+ return ';'
+ }
+ if tabs > commas {
+ return '\t'
+ }
+ return ','
+}
+
+// safeCol returns the value at index i, or "" if out of bounds.
+func safeCol(row []string, i int) string {
+ if i < 0 || i >= len(row) {
+ return ""
+ }
+ return strings.TrimSpace(row[i])
+}
+
+// parseFlexDate tries multiple date formats and returns YYYY-MM-DD.
+func parseFlexDate(s string) string {
+ s = strings.TrimSpace(s)
+ if s == "" {
+ return ""
+ }
+ formats := []string{
+ "2006-01-02",
+ "02.01.2006", // DD.MM.YYYY (common in EU)
+ "01/02/2006", // MM/DD/YYYY
+ "02/01/2006", // DD/MM/YYYY
+ "2006/01/02",
+ "Jan 2, 2006",
+ "2 Jan 2006",
+ "02-01-2006",
+ "01-02-2006",
+ time.RFC3339,
+ }
+ for _, f := range formats {
+ if t, err := time.Parse(f, s); err == nil {
+ return t.Format("2006-01-02")
+ }
+ }
+ return ""
+}
+
+// parseAmount parses a monetary amount string, handling comma/dot decimals and negative formats.
+func parseAmount(s string) float64 {
+ s = strings.TrimSpace(s)
+ if s == "" {
+ return 0
+ }
+ // Remove currency symbols and whitespace
+ s = strings.NewReplacer("β¬", "", "$", "", "Β£", "", " ", "", "\u00a0", "").Replace(s)
+
+ // Handle European format: 1.234,56 β 1234.56
+ if strings.Contains(s, ",") && strings.Contains(s, ".") {
+ if strings.LastIndex(s, ",") > strings.LastIndex(s, ".") {
+ // comma is decimal: 1.234,56
+ s = strings.ReplaceAll(s, ".", "")
+ s = strings.ReplaceAll(s, ",", ".")
+ } else {
+ // dot is decimal: 1,234.56
+ s = strings.ReplaceAll(s, ",", "")
+ }
+ } else if strings.Contains(s, ",") {
+ // Only comma: assume decimal separator
+ s = strings.ReplaceAll(s, ",", ".")
+ }
+
+ v, err := strconv.ParseFloat(s, 64)
+ if err != nil {
+ return 0
+ }
+ return v
+}
diff --git a/pkg/server/bus.go b/pkg/server/bus.go
new file mode 100644
index 0000000..8c88e92
--- /dev/null
+++ b/pkg/server/bus.go
@@ -0,0 +1,241 @@
+package server
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+ "log"
+ "net/http"
+ "sync"
+ "time"
+)
+
+// Bus implements a simple long-polling message bus for Discuss.
+// Mirrors: odoo/addons/bus/models/bus.py ImBus
+//
+// Channels subscribe to notifications. A long-poll request blocks until
+// a notification arrives or the timeout expires.
+type Bus struct {
+ mu sync.Mutex
+ channels map[int64][]chan busNotification
+ lastID int64
+}
+
+type busNotification struct {
+ ID int64 `json:"id"`
+ Channel string `json:"channel"`
+ Message interface{} `json:"message"`
+}
+
+// NewBus creates a new message bus.
+func NewBus() *Bus {
+ return &Bus{
+ channels: make(map[int64][]chan busNotification),
+ }
+}
+
+// Notify sends a notification to all subscribers of a channel.
+func (b *Bus) Notify(channelID int64, channel string, message interface{}) {
+ b.mu.Lock()
+ b.lastID++
+ notif := busNotification{
+ ID: b.lastID,
+ Channel: channel,
+ Message: message,
+ }
+ subs := b.channels[channelID]
+ b.mu.Unlock()
+
+ for _, ch := range subs {
+ select {
+ case ch <- notif:
+ default:
+ // subscriber buffer full, skip
+ }
+ }
+}
+
+// Subscribe creates a subscription for a partner's channels.
+func (b *Bus) Subscribe(partnerID int64) chan busNotification {
+ ch := make(chan busNotification, 10)
+ b.mu.Lock()
+ b.channels[partnerID] = append(b.channels[partnerID], ch)
+ b.mu.Unlock()
+ return ch
+}
+
+// Unsubscribe removes a subscription.
+func (b *Bus) Unsubscribe(partnerID int64, ch chan busNotification) {
+ b.mu.Lock()
+ defer b.mu.Unlock()
+ subs := b.channels[partnerID]
+ for i, s := range subs {
+ if s == ch {
+ b.channels[partnerID] = append(subs[:i], subs[i+1:]...)
+ close(ch)
+ return
+ }
+ }
+}
+
+// registerBusRoutes adds the long-polling endpoint.
+func (s *Server) registerBusRoutes() {
+ if s.bus == nil {
+ s.bus = NewBus()
+ }
+ s.mux.HandleFunc("/longpolling/poll", s.handleBusPoll)
+ s.mux.HandleFunc("/discuss/channel/messages", s.handleDiscussMessages)
+ s.mux.HandleFunc("/discuss/channel/list", s.handleDiscussChannelList)
+}
+
+// handleBusPoll implements long-polling for real-time notifications.
+// Mirrors: odoo/addons/bus/controllers/main.py poll()
+func (s *Server) handleBusPoll(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+
+ sess := GetSession(r)
+ if sess == nil {
+ writeJSON(w, []interface{}{})
+ return
+ }
+
+ // Get partner ID
+ var partnerID int64
+ s.pool.QueryRow(r.Context(),
+ `SELECT COALESCE(partner_id, 0) FROM res_users WHERE id = $1`, sess.UID,
+ ).Scan(&partnerID)
+
+ if partnerID == 0 {
+ writeJSON(w, []interface{}{})
+ return
+ }
+
+ // Subscribe and wait for notifications (max 30s)
+ ch := s.bus.Subscribe(partnerID)
+ defer s.bus.Unsubscribe(partnerID, ch)
+
+ ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+ defer cancel()
+
+ select {
+ case notif := <-ch:
+ writeJSON(w, []busNotification{notif})
+ case <-ctx.Done():
+ writeJSON(w, []interface{}{}) // timeout, empty response
+ }
+}
+
+// handleDiscussMessages fetches messages for a channel via JSON-RPC.
+func (s *Server) handleDiscussMessages(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+
+ sess := GetSession(r)
+ if sess == nil {
+ s.writeJSONRPC(w, nil, nil, &RPCError{Code: 100, Message: "Not authenticated"})
+ return
+ }
+
+ var req JSONRPCRequest
+ if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+ s.writeJSONRPC(w, nil, nil, &RPCError{Code: -32700, Message: "Parse error"})
+ return
+ }
+
+ var params struct {
+ ChannelID int64 `json:"channel_id"`
+ Limit int `json:"limit"`
+ }
+ if err := json.Unmarshal(req.Params, ¶ms); err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: "Invalid params"})
+ return
+ }
+ if params.Limit <= 0 {
+ params.Limit = 50
+ }
+
+ rows, err := s.pool.Query(r.Context(),
+ `SELECT m.id, m.body, m.date, m.author_id, COALESCE(p.name, '')
+ FROM mail_message m
+ LEFT JOIN res_partner p ON p.id = m.author_id
+ WHERE m.model = 'mail.channel' AND m.res_id = $1
+ ORDER BY m.id DESC LIMIT $2`, params.ChannelID, params.Limit)
+ if err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32603, Message: fmt.Sprintf("Query: %v", err)})
+ return
+ }
+ defer rows.Close()
+
+ var messages []map[string]interface{}
+ for rows.Next() {
+ var id, authorID int64
+ var body, authorName string
+ var date interface{}
+ if err := rows.Scan(&id, &body, &date, &authorID, &authorName); err != nil {
+ continue
+ }
+ msg := map[string]interface{}{
+ "id": id, "body": body, "date": date,
+ }
+ if authorID > 0 {
+ msg["author_id"] = []interface{}{authorID, authorName}
+ } else {
+ msg["author_id"] = false
+ }
+ messages = append(messages, msg)
+ }
+ if messages == nil {
+ messages = []map[string]interface{}{}
+ }
+ s.writeJSONRPC(w, req.ID, messages, nil)
+}
+
+// handleDiscussChannelList returns channels the current user is member of.
+func (s *Server) handleDiscussChannelList(w http.ResponseWriter, r *http.Request) {
+ sess := GetSession(r)
+ if sess == nil {
+ s.writeJSONRPC(w, nil, nil, &RPCError{Code: 100, Message: "Not authenticated"})
+ return
+ }
+
+ var partnerID int64
+ s.pool.QueryRow(r.Context(),
+ `SELECT COALESCE(partner_id, 0) FROM res_users WHERE id = $1`, sess.UID,
+ ).Scan(&partnerID)
+
+ rows, err := s.pool.Query(r.Context(),
+ `SELECT c.id, c.name, c.channel_type,
+ (SELECT COUNT(*) FROM mail_channel_member WHERE channel_id = c.id) AS members
+ FROM mail_channel c
+ JOIN mail_channel_member cm ON cm.channel_id = c.id AND cm.partner_id = $1
+ WHERE c.active = true
+ ORDER BY c.last_message_date DESC NULLS LAST`, partnerID)
+ if err != nil {
+ log.Printf("discuss: channel list error: %v", err)
+ writeJSON(w, []interface{}{})
+ return
+ }
+ defer rows.Close()
+
+ var channels []map[string]interface{}
+ for rows.Next() {
+ var id int64
+ var name, channelType string
+ var members int64
+ if err := rows.Scan(&id, &name, &channelType, &members); err != nil {
+ continue
+ }
+ channels = append(channels, map[string]interface{}{
+ "id": id, "name": name, "channel_type": channelType, "member_count": members,
+ })
+ }
+ if channels == nil {
+ channels = []map[string]interface{}{}
+ }
+ writeJSON(w, channels)
+}
diff --git a/pkg/server/export.go b/pkg/server/export.go
index 9c6e866..3c83c3d 100644
--- a/pkg/server/export.go
+++ b/pkg/server/export.go
@@ -6,37 +6,45 @@ import (
"fmt"
"net/http"
+ "github.com/xuri/excelize/v2"
"odoo-go/pkg/orm"
)
-// handleExportCSV exports records as CSV.
-// Mirrors: odoo/addons/web/controllers/export.py ExportController
-func (s *Server) handleExportCSV(w http.ResponseWriter, r *http.Request) {
- if r.Method != http.MethodPost {
- http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
- return
- }
+// exportField describes a field in an export request.
+type exportField struct {
+ Name string `json:"name"`
+ Label string `json:"label"`
+}
+// exportData holds the parsed and fetched data for an export operation.
+type exportData struct {
+ Model string
+ FieldNames []string
+ Headers []string
+ Records []orm.Values
+}
+
+// parseExportRequest parses the common request/params/env/search logic shared by CSV and XLSX export.
+func (s *Server) parseExportRequest(w http.ResponseWriter, r *http.Request) (*exportData, error) {
var req JSONRPCRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
s.writeJSONRPC(w, nil, nil, &RPCError{Code: -32700, Message: "Parse error"})
- return
+ return nil, err
}
var params struct {
Data struct {
- Model string `json:"model"`
- Fields []exportField `json:"fields"`
- Domain []interface{} `json:"domain"`
- IDs []float64 `json:"ids"`
+ Model string `json:"model"`
+ Fields []exportField `json:"fields"`
+ Domain []interface{} `json:"domain"`
+ IDs []float64 `json:"ids"`
} `json:"data"`
}
if err := json.Unmarshal(req.Params, ¶ms); err != nil {
s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: "Invalid params"})
- return
+ return nil, err
}
- // Extract UID from session
uid := int64(1)
companyID := int64(1)
if sess := GetSession(r); sess != nil {
@@ -45,42 +53,31 @@ func (s *Server) handleExportCSV(w http.ResponseWriter, r *http.Request) {
}
env, err := orm.NewEnvironment(r.Context(), orm.EnvConfig{
- Pool: s.pool,
- UID: uid,
- CompanyID: companyID,
+ Pool: s.pool, UID: uid, CompanyID: companyID,
})
if err != nil {
http.Error(w, "Internal error", http.StatusInternalServerError)
- return
+ return nil, err
}
defer env.Close()
rs := env.Model(params.Data.Model)
- // Determine which record IDs to export
var ids []int64
if len(params.Data.IDs) > 0 {
for _, id := range params.Data.IDs {
ids = append(ids, int64(id))
}
} else {
- // Search with domain
domain := parseDomain([]interface{}{params.Data.Domain})
found, err := rs.Search(domain, orm.SearchOpts{Limit: 10000})
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
- return
+ return nil, err
}
ids = found.IDs()
}
- if len(ids) == 0 {
- w.Header().Set("Content-Type", "text/csv")
- w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s.csv", params.Data.Model))
- return
- }
-
- // Extract field names
var fieldNames []string
var headers []string
for _, f := range params.Data.Fields {
@@ -92,42 +89,89 @@ func (s *Server) handleExportCSV(w http.ResponseWriter, r *http.Request) {
headers = append(headers, label)
}
- // Read records
- records, err := rs.Browse(ids...).Read(fieldNames)
- if err != nil {
- http.Error(w, err.Error(), http.StatusInternalServerError)
- return
+ var records []orm.Values
+ if len(ids) > 0 {
+ records, err = rs.Browse(ids...).Read(fieldNames)
+ if err != nil {
+ http.Error(w, err.Error(), http.StatusInternalServerError)
+ return nil, err
+ }
}
if err := env.Commit(); err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
+ return nil, err
+ }
+
+ return &exportData{
+ Model: params.Data.Model, FieldNames: fieldNames, Headers: headers, Records: records,
+ }, nil
+}
+
+// handleExportCSV exports records as CSV.
+// Mirrors: odoo/addons/web/controllers/export.py ExportController
+func (s *Server) handleExportCSV(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+
+ data, err := s.parseExportRequest(w, r)
+ if err != nil {
return
}
- // Write CSV
w.Header().Set("Content-Type", "text/csv; charset=utf-8")
- w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s.csv", params.Data.Model))
+ w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s.csv", data.Model))
writer := csv.NewWriter(w)
defer writer.Flush()
- // Header row
- writer.Write(headers)
-
- // Data rows
- for _, rec := range records {
- row := make([]string, len(fieldNames))
- for i, fname := range fieldNames {
+ writer.Write(data.Headers)
+ for _, rec := range data.Records {
+ row := make([]string, len(data.FieldNames))
+ for i, fname := range data.FieldNames {
row[i] = formatCSVValue(rec[fname])
}
writer.Write(row)
}
}
-// exportField describes a field in an export request.
-type exportField struct {
- Name string `json:"name"`
- Label string `json:"label"`
+// handleExportXLSX exports records as XLSX (Excel).
+// Mirrors: odoo/addons/web/controllers/export.py ExportXlsxController
+func (s *Server) handleExportXLSX(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+
+ data, err := s.parseExportRequest(w, r)
+ if err != nil {
+ return
+ }
+
+ f := excelize.NewFile()
+ sheet := "Sheet1"
+
+ headerStyle, _ := f.NewStyle(&excelize.Style{
+ Font: &excelize.Font{Bold: true},
+ })
+ for i, h := range data.Headers {
+ cell, _ := excelize.CoordinatesToCellName(i+1, 1)
+ f.SetCellValue(sheet, cell, h)
+ f.SetCellStyle(sheet, cell, cell, headerStyle)
+ }
+
+ for rowIdx, rec := range data.Records {
+ for colIdx, fname := range data.FieldNames {
+ cell, _ := excelize.CoordinatesToCellName(colIdx+1, rowIdx+2)
+ f.SetCellValue(sheet, cell, formatCSVValue(rec[fname]))
+ }
+ }
+
+ w.Header().Set("Content-Type", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
+ w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s.xlsx", data.Model))
+ f.Write(w)
}
// formatCSVValue converts a field value to a CSV string.
diff --git a/pkg/server/image.go b/pkg/server/image.go
index 87d26fc..d12189a 100644
--- a/pkg/server/image.go
+++ b/pkg/server/image.go
@@ -2,6 +2,7 @@ package server
import (
"fmt"
+ "log"
"net/http"
"strconv"
"strings"
@@ -55,9 +56,11 @@ func (s *Server) handleImage(w http.ResponseWriter, r *http.Request) {
table := m.Table()
var data []byte
ctx := r.Context()
- _ = s.pool.QueryRow(ctx,
+ if err := s.pool.QueryRow(ctx,
fmt.Sprintf(`SELECT "%s" FROM "%s" WHERE id = $1`, f.Column(), table), id,
- ).Scan(&data)
+ ).Scan(&data); err != nil {
+ log.Printf("warning: image query failed for %s.%s id=%d: %v", model, field, id, err)
+ }
if len(data) > 0 {
// Detect content type
contentType := http.DetectContentType(data)
@@ -76,9 +79,11 @@ func (s *Server) handleImage(w http.ResponseWriter, r *http.Request) {
m := orm.Registry.Get(model)
if m != nil {
var name string
- _ = s.pool.QueryRow(r.Context(),
+ if err := s.pool.QueryRow(r.Context(),
fmt.Sprintf(`SELECT COALESCE(name, '') FROM "%s" WHERE id = $1`, m.Table()), id,
- ).Scan(&name)
+ ).Scan(&name); err != nil {
+ log.Printf("warning: image name lookup failed for %s id=%d: %v", model, id, err)
+ }
if len(name) > 0 {
initial = strings.ToUpper(name[:1])
}
diff --git a/pkg/server/import.go b/pkg/server/import.go
new file mode 100644
index 0000000..bbe465d
--- /dev/null
+++ b/pkg/server/import.go
@@ -0,0 +1,223 @@
+package server
+
+import (
+ "encoding/csv"
+ "encoding/json"
+ "fmt"
+ "io"
+ "log"
+ "net/http"
+ "strconv"
+ "strings"
+
+ "odoo-go/pkg/orm"
+)
+
+// handleImportCSV imports records from a CSV file into any model.
+// Accepts JSON body with: model, fields (mapping), csv_data (raw CSV string).
+// Mirrors: odoo/addons/base_import/controllers/main.py ImportController
+func (s *Server) handleImportCSV(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+
+ var req JSONRPCRequest
+ if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+ s.writeJSONRPC(w, nil, nil, &RPCError{Code: -32700, Message: "Parse error"})
+ return
+ }
+
+ var params struct {
+ Model string `json:"model"`
+ Fields []importFieldMap `json:"fields"`
+ CSVData string `json:"csv_data"`
+ HasHeader bool `json:"has_header"`
+ DryRun bool `json:"dry_run"`
+ }
+ if err := json.Unmarshal(req.Params, ¶ms); err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: "Invalid params"})
+ return
+ }
+
+ if params.Model == "" || len(params.Fields) == 0 || params.CSVData == "" {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: "model, fields, and csv_data are required"})
+ return
+ }
+
+ // Verify model exists
+ m := orm.Registry.Get(params.Model)
+ if m == nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: fmt.Sprintf("Unknown model: %s", params.Model)})
+ return
+ }
+
+ // Parse CSV
+ reader := csv.NewReader(strings.NewReader(params.CSVData))
+ reader.LazyQuotes = true
+ reader.TrimLeadingSpace = true
+
+ var allRows [][]string
+ for {
+ row, err := reader.Read()
+ if err == io.EOF {
+ break
+ }
+ if err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: fmt.Sprintf("CSV parse error: %v", err)})
+ return
+ }
+ allRows = append(allRows, row)
+ }
+
+ if len(allRows) == 0 {
+ s.writeJSONRPC(w, req.ID, map[string]interface{}{"ids": []int64{}, "count": 0}, nil)
+ return
+ }
+
+ // Skip header row if present
+ dataRows := allRows
+ if params.HasHeader && len(allRows) > 1 {
+ dataRows = allRows[1:]
+ }
+
+ // Build field mapping: CSV column index β ORM field name
+ type colMapping struct {
+ colIndex int
+ fieldName string
+ fieldType orm.FieldType
+ }
+ var mappings []colMapping
+ for _, fm := range params.Fields {
+ if fm.FieldName == "" || fm.ColumnIndex < 0 {
+ continue
+ }
+ f := m.GetField(fm.FieldName)
+ if f == nil {
+ continue // skip unknown fields
+ }
+ mappings = append(mappings, colMapping{
+ colIndex: fm.ColumnIndex,
+ fieldName: fm.FieldName,
+ fieldType: f.Type,
+ })
+ }
+
+ if len(mappings) == 0 {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32602, Message: "No valid field mappings"})
+ return
+ }
+
+ uid := int64(1)
+ companyID := int64(1)
+ if sess := GetSession(r); sess != nil {
+ uid = sess.UID
+ companyID = sess.CompanyID
+ }
+
+ env, err := orm.NewEnvironment(r.Context(), orm.EnvConfig{
+ Pool: s.pool,
+ UID: uid,
+ CompanyID: companyID,
+ })
+ if err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32603, Message: "Internal error"})
+ return
+ }
+ defer env.Close()
+
+ rs := env.Model(params.Model)
+
+ var createdIDs []int64
+ var errors []importError
+
+ for rowIdx, row := range dataRows {
+ vals := make(orm.Values)
+ for _, cm := range mappings {
+ if cm.colIndex >= len(row) {
+ continue
+ }
+ raw := strings.TrimSpace(row[cm.colIndex])
+ if raw == "" {
+ continue
+ }
+ vals[cm.fieldName] = coerceImportValue(raw, cm.fieldType)
+ }
+
+ if len(vals) == 0 {
+ continue
+ }
+
+ if params.DryRun {
+ continue // validate only, don't create
+ }
+
+ rec, err := rs.Create(vals)
+ if err != nil {
+ errors = append(errors, importError{
+ Row: rowIdx + 1,
+ Message: err.Error(),
+ })
+ log.Printf("import: row %d error: %v", rowIdx+1, err)
+ continue
+ }
+ createdIDs = append(createdIDs, rec.ID())
+ }
+
+ if err := env.Commit(); err != nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: -32603, Message: fmt.Sprintf("Commit error: %v", err)})
+ return
+ }
+
+ result := map[string]interface{}{
+ "ids": createdIDs,
+ "count": len(createdIDs),
+ "errors": errors,
+ "dry_run": params.DryRun,
+ }
+ s.writeJSONRPC(w, req.ID, result, nil)
+}
+
+// importFieldMap maps a CSV column to an ORM field.
+type importFieldMap struct {
+ ColumnIndex int `json:"column_index"`
+ FieldName string `json:"field_name"`
+}
+
+// importError describes a per-row import error.
+type importError struct {
+ Row int `json:"row"`
+ Message string `json:"message"`
+}
+
+// coerceImportValue converts a raw CSV string to the appropriate Go type for ORM Create.
+func coerceImportValue(raw string, ft orm.FieldType) interface{} {
+ switch ft {
+ case orm.TypeInteger:
+ v, err := strconv.ParseInt(raw, 10, 64)
+ if err != nil {
+ return nil
+ }
+ return v
+ case orm.TypeFloat, orm.TypeMonetary:
+ // Handle comma as decimal separator
+ raw = strings.ReplaceAll(raw, ",", ".")
+ v, err := strconv.ParseFloat(raw, 64)
+ if err != nil {
+ return nil
+ }
+ return v
+ case orm.TypeBoolean:
+ lower := strings.ToLower(raw)
+ return lower == "true" || lower == "1" || lower == "yes" || lower == "ja"
+ case orm.TypeMany2one:
+ // Try as integer ID first, then as name_search later
+ v, err := strconv.ParseInt(raw, 10, 64)
+ if err != nil {
+ return raw // pass as string, ORM may handle name_create
+ }
+ return v
+ default:
+ return raw
+ }
+}
diff --git a/pkg/server/middleware.go b/pkg/server/middleware.go
index 41344e7..ac16f7b 100644
--- a/pkg/server/middleware.go
+++ b/pkg/server/middleware.go
@@ -4,6 +4,7 @@ import (
"context"
"log"
"net/http"
+ "path/filepath"
"strings"
"time"
)
@@ -43,13 +44,19 @@ func (w *statusWriter) WriteHeader(code int) {
func AuthMiddleware(store *SessionStore, next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// Public endpoints (no auth required)
- path := r.URL.Path
+ path := filepath.Clean(r.URL.Path)
if path == "/health" ||
path == "/web/login" ||
path == "/web/session/authenticate" ||
path == "/web/session/logout" ||
- strings.HasPrefix(path, "/web/database/") ||
+ path == "/web/database/manager" ||
+ path == "/web/database/create" ||
+ path == "/web/database/list" ||
path == "/web/webclient/version_info" ||
+ path == "/web/setup/wizard" ||
+ path == "/web/setup/wizard/save" ||
+ path == "/web/portal/signup" ||
+ path == "/web/portal/reset_password" ||
strings.Contains(path, "/static/") {
next.ServeHTTP(w, r)
return
@@ -58,8 +65,14 @@ func AuthMiddleware(store *SessionStore, next http.Handler) http.Handler {
// Check session cookie
cookie, err := r.Cookie("session_id")
if err != nil || cookie.Value == "" {
- // Also check JSON-RPC params for session_id (Odoo sends it both ways)
- next.ServeHTTP(w, r) // For now, allow through β UID defaults to 1
+ // No session cookie β reject protected endpoints
+ if r.Header.Get("Content-Type") == "application/json" ||
+ strings.HasPrefix(path, "/web/dataset/") ||
+ strings.HasPrefix(path, "/jsonrpc") {
+ http.Error(w, `{"jsonrpc":"2.0","error":{"code":100,"message":"Session expired"}}`, http.StatusUnauthorized)
+ } else {
+ http.Redirect(w, r, "/web/login", http.StatusFound)
+ }
return
}
diff --git a/pkg/server/portal.go b/pkg/server/portal.go
new file mode 100644
index 0000000..bc88c1c
--- /dev/null
+++ b/pkg/server/portal.go
@@ -0,0 +1,379 @@
+// Package server β Portal controllers for external (customer/supplier) access.
+// Mirrors: odoo/addons/portal/controllers/portal.py CustomerPortal
+package server
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+ "log"
+ "net/http"
+ "time"
+)
+
+// registerPortalRoutes registers all /my/* portal endpoints.
+func (s *Server) registerPortalRoutes() {
+ s.mux.HandleFunc("/my", s.handlePortalHome)
+ s.mux.HandleFunc("/my/", s.handlePortalDispatch)
+ s.mux.HandleFunc("/my/home", s.handlePortalHome)
+ s.mux.HandleFunc("/my/invoices", s.handlePortalInvoices)
+ s.mux.HandleFunc("/my/orders", s.handlePortalOrders)
+ s.mux.HandleFunc("/my/pickings", s.handlePortalPickings)
+ s.mux.HandleFunc("/my/account", s.handlePortalAccount)
+}
+
+// handlePortalDispatch routes /my/* sub-paths to the correct handler.
+func (s *Server) handlePortalDispatch(w http.ResponseWriter, r *http.Request) {
+ switch r.URL.Path {
+ case "/my/home":
+ s.handlePortalHome(w, r)
+ case "/my/invoices":
+ s.handlePortalInvoices(w, r)
+ case "/my/orders":
+ s.handlePortalOrders(w, r)
+ case "/my/pickings":
+ s.handlePortalPickings(w, r)
+ case "/my/account":
+ s.handlePortalAccount(w, r)
+ default:
+ s.handlePortalHome(w, r)
+ }
+}
+
+// portalPartnerID resolves the partner_id of the currently logged-in portal user.
+// Returns (partnerID, error). If session is missing, writes an error response and returns 0.
+func (s *Server) portalPartnerID(w http.ResponseWriter, r *http.Request) (int64, bool) {
+ sess := GetSession(r)
+ if sess == nil {
+ writePortalError(w, http.StatusUnauthorized, "Not authenticated")
+ return 0, false
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+ defer cancel()
+
+ var partnerID int64
+ err := s.pool.QueryRow(ctx,
+ `SELECT partner_id FROM res_users WHERE id = $1 AND active = true`,
+ sess.UID).Scan(&partnerID)
+ if err != nil {
+ log.Printf("portal: cannot resolve partner_id for uid=%d: %v", sess.UID, err)
+ writePortalError(w, http.StatusForbidden, "User not found")
+ return 0, false
+ }
+ return partnerID, true
+}
+
+// handlePortalHome returns the portal dashboard with document counts.
+// Mirrors: odoo/addons/portal/controllers/portal.py CustomerPortal.home()
+func (s *Server) handlePortalHome(w http.ResponseWriter, r *http.Request) {
+ partnerID, ok := s.portalPartnerID(w, r)
+ if !ok {
+ return
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+ defer cancel()
+
+ var invoiceCount, orderCount, pickingCount int64
+
+ // Count invoices (account.move with move_type in ('out_invoice','out_refund'))
+ err := s.pool.QueryRow(ctx,
+ `SELECT COUNT(*) FROM account_move
+ WHERE partner_id = $1 AND move_type IN ('out_invoice','out_refund')
+ AND state = 'posted'`, partnerID).Scan(&invoiceCount)
+ if err != nil {
+ log.Printf("portal: invoice count error: %v", err)
+ }
+
+ // Count sale orders (confirmed or done)
+ err = s.pool.QueryRow(ctx,
+ `SELECT COUNT(*) FROM sale_order
+ WHERE partner_id = $1 AND state IN ('sale','done')`, partnerID).Scan(&orderCount)
+ if err != nil {
+ log.Printf("portal: order count error: %v", err)
+ }
+
+ // Count pickings (stock.picking)
+ err = s.pool.QueryRow(ctx,
+ `SELECT COUNT(*) FROM stock_picking
+ WHERE partner_id = $1 AND state != 'cancel'`, partnerID).Scan(&pickingCount)
+ if err != nil {
+ log.Printf("portal: picking count error: %v", err)
+ }
+
+ writePortalJSON(w, map[string]interface{}{
+ "counters": map[string]int64{
+ "invoice_count": invoiceCount,
+ "order_count": orderCount,
+ "picking_count": pickingCount,
+ },
+ })
+}
+
+// handlePortalInvoices lists invoices for the current portal user.
+// Mirrors: odoo/addons/portal/controllers/portal.py CustomerPortal.portal_my_invoices()
+func (s *Server) handlePortalInvoices(w http.ResponseWriter, r *http.Request) {
+ partnerID, ok := s.portalPartnerID(w, r)
+ if !ok {
+ return
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+ defer cancel()
+
+ rows, err := s.pool.Query(ctx,
+ `SELECT m.id, m.name, m.move_type, m.state, m.date,
+ m.amount_total::float8, m.amount_residual::float8,
+ m.payment_state, COALESCE(m.ref, '')
+ FROM account_move m
+ WHERE m.partner_id = $1
+ AND m.move_type IN ('out_invoice','out_refund')
+ AND m.state = 'posted'
+ ORDER BY m.date DESC
+ LIMIT 80`, partnerID)
+ if err != nil {
+ log.Printf("portal: invoice query error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to load invoices")
+ return
+ }
+ defer rows.Close()
+
+ var invoices []map[string]interface{}
+ for rows.Next() {
+ var id int64
+ var name, moveType, state, paymentState, ref string
+ var date time.Time
+ var amountTotal, amountResidual float64
+ if err := rows.Scan(&id, &name, &moveType, &state, &date,
+ &amountTotal, &amountResidual, &paymentState, &ref); err != nil {
+ log.Printf("portal: invoice scan error: %v", err)
+ continue
+ }
+ invoices = append(invoices, map[string]interface{}{
+ "id": id,
+ "name": name,
+ "move_type": moveType,
+ "state": state,
+ "date": date.Format("2006-01-02"),
+ "amount_total": amountTotal,
+ "amount_residual": amountResidual,
+ "payment_state": paymentState,
+ "ref": ref,
+ })
+ }
+ if invoices == nil {
+ invoices = []map[string]interface{}{}
+ }
+ writePortalJSON(w, map[string]interface{}{"invoices": invoices})
+}
+
+// handlePortalOrders lists sale orders for the current portal user.
+// Mirrors: odoo/addons/portal/controllers/portal.py CustomerPortal.portal_my_orders()
+func (s *Server) handlePortalOrders(w http.ResponseWriter, r *http.Request) {
+ partnerID, ok := s.portalPartnerID(w, r)
+ if !ok {
+ return
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+ defer cancel()
+
+ rows, err := s.pool.Query(ctx,
+ `SELECT so.id, so.name, so.state, so.date_order,
+ so.amount_total::float8, COALESCE(so.invoice_status, ''),
+ COALESCE(so.delivery_status, '')
+ FROM sale_order so
+ WHERE so.partner_id = $1
+ AND so.state IN ('sale','done')
+ ORDER BY so.date_order DESC
+ LIMIT 80`, partnerID)
+ if err != nil {
+ log.Printf("portal: order query error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to load orders")
+ return
+ }
+ defer rows.Close()
+
+ var orders []map[string]interface{}
+ for rows.Next() {
+ var id int64
+ var name, state, invoiceStatus, deliveryStatus string
+ var dateOrder time.Time
+ var amountTotal float64
+ if err := rows.Scan(&id, &name, &state, &dateOrder,
+ &amountTotal, &invoiceStatus, &deliveryStatus); err != nil {
+ log.Printf("portal: order scan error: %v", err)
+ continue
+ }
+ orders = append(orders, map[string]interface{}{
+ "id": id,
+ "name": name,
+ "state": state,
+ "date_order": dateOrder.Format("2006-01-02 15:04:05"),
+ "amount_total": amountTotal,
+ "invoice_status": invoiceStatus,
+ "delivery_status": deliveryStatus,
+ })
+ }
+ if orders == nil {
+ orders = []map[string]interface{}{}
+ }
+ writePortalJSON(w, map[string]interface{}{"orders": orders})
+}
+
+// handlePortalPickings lists stock pickings for the current portal user.
+// Mirrors: odoo/addons/portal/controllers/portal.py CustomerPortal.portal_my_pickings()
+func (s *Server) handlePortalPickings(w http.ResponseWriter, r *http.Request) {
+ partnerID, ok := s.portalPartnerID(w, r)
+ if !ok {
+ return
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+ defer cancel()
+
+ rows, err := s.pool.Query(ctx,
+ `SELECT sp.id, sp.name, sp.state, sp.scheduled_date,
+ COALESCE(sp.origin, ''),
+ COALESCE(spt.name, '') AS picking_type_name
+ FROM stock_picking sp
+ LEFT JOIN stock_picking_type spt ON spt.id = sp.picking_type_id
+ WHERE sp.partner_id = $1
+ AND sp.state != 'cancel'
+ ORDER BY sp.scheduled_date DESC
+ LIMIT 80`, partnerID)
+ if err != nil {
+ log.Printf("portal: picking query error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to load pickings")
+ return
+ }
+ defer rows.Close()
+
+ var pickings []map[string]interface{}
+ for rows.Next() {
+ var id int64
+ var name, state, origin, pickingTypeName string
+ var scheduledDate time.Time
+ if err := rows.Scan(&id, &name, &state, &scheduledDate,
+ &origin, &pickingTypeName); err != nil {
+ log.Printf("portal: picking scan error: %v", err)
+ continue
+ }
+ pickings = append(pickings, map[string]interface{}{
+ "id": id,
+ "name": name,
+ "state": state,
+ "scheduled_date": scheduledDate.Format("2006-01-02 15:04:05"),
+ "origin": origin,
+ "picking_type_name": pickingTypeName,
+ })
+ }
+ if pickings == nil {
+ pickings = []map[string]interface{}{}
+ }
+ writePortalJSON(w, map[string]interface{}{"pickings": pickings})
+}
+
+// handlePortalAccount returns/updates the portal user's profile.
+// GET: returns user profile. POST: updates name/email/phone/street/city/zip.
+// Mirrors: odoo/addons/portal/controllers/portal.py CustomerPortal.account()
+func (s *Server) handlePortalAccount(w http.ResponseWriter, r *http.Request) {
+ partnerID, ok := s.portalPartnerID(w, r)
+ if !ok {
+ return
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+ defer cancel()
+
+ if r.Method == http.MethodPost {
+ // Update profile
+ var body struct {
+ Name *string `json:"name"`
+ Email *string `json:"email"`
+ Phone *string `json:"phone"`
+ Street *string `json:"street"`
+ City *string `json:"city"`
+ Zip *string `json:"zip"`
+ }
+ if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+ writePortalError(w, http.StatusBadRequest, "Invalid JSON")
+ return
+ }
+
+ // Build SET clause dynamically with parameterized placeholders
+ sets := make([]string, 0, 6)
+ args := make([]interface{}, 0, 7)
+ idx := 1
+ addField := func(col string, val *string) {
+ if val != nil {
+ sets = append(sets, fmt.Sprintf("%s = $%d", col, idx))
+ args = append(args, *val)
+ idx++
+ }
+ }
+ addField("name", body.Name)
+ addField("email", body.Email)
+ addField("phone", body.Phone)
+ addField("street", body.Street)
+ addField("city", body.City)
+ addField("zip", body.Zip)
+
+ if len(sets) > 0 {
+ args = append(args, partnerID)
+ query := "UPDATE res_partner SET "
+ for j, set := range sets {
+ if j > 0 {
+ query += ", "
+ }
+ query += set
+ }
+ query += fmt.Sprintf(" WHERE id = $%d", idx)
+ if _, err := s.pool.Exec(ctx, query, args...); err != nil {
+ log.Printf("portal: account update error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Update failed")
+ return
+ }
+ }
+
+ writePortalJSON(w, map[string]interface{}{"success": true})
+ return
+ }
+
+ // GET β return profile
+ var name, email, phone, street, city, zip string
+ err := s.pool.QueryRow(ctx,
+ `SELECT COALESCE(name,''), COALESCE(email,''), COALESCE(phone,''),
+ COALESCE(street,''), COALESCE(city,''), COALESCE(zip,'')
+ FROM res_partner WHERE id = $1`, partnerID).Scan(
+ &name, &email, &phone, &street, &city, &zip)
+ if err != nil {
+ log.Printf("portal: account read error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to load profile")
+ return
+ }
+
+ writePortalJSON(w, map[string]interface{}{
+ "name": name,
+ "email": email,
+ "phone": phone,
+ "street": street,
+ "city": city,
+ "zip": zip,
+ })
+}
+
+// --- Helpers ---
+
+func writePortalJSON(w http.ResponseWriter, data interface{}) {
+ w.Header().Set("Content-Type", "application/json")
+ w.Header().Set("Cache-Control", "no-store")
+ json.NewEncoder(w).Encode(data)
+}
+
+func writePortalError(w http.ResponseWriter, status int, message string) {
+ w.Header().Set("Content-Type", "application/json")
+ w.WriteHeader(status)
+ json.NewEncoder(w).Encode(map[string]string{"error": message})
+}
diff --git a/pkg/server/portal_signup.go b/pkg/server/portal_signup.go
new file mode 100644
index 0000000..3aac82a
--- /dev/null
+++ b/pkg/server/portal_signup.go
@@ -0,0 +1,313 @@
+// Package server β Portal signup and password reset.
+// Mirrors: odoo/addons/auth_signup/controllers/main.py AuthSignupHome
+package server
+
+import (
+ "context"
+ "crypto/rand"
+ "encoding/hex"
+ "encoding/json"
+ "fmt"
+ "log"
+ "net/http"
+ "strings"
+ "time"
+
+ "odoo-go/pkg/tools"
+)
+
+// registerPortalSignupRoutes registers /web/portal/* public endpoints.
+func (s *Server) registerPortalSignupRoutes() {
+ s.mux.HandleFunc("/web/portal/signup", s.handlePortalSignup)
+ s.mux.HandleFunc("/web/portal/reset_password", s.handlePortalResetPassword)
+}
+
+// handlePortalSignup creates a new portal user with share=true and a matching res.partner.
+// Mirrors: odoo/addons/auth_signup/controllers/main.py AuthSignupHome.web_auth_signup()
+func (s *Server) handlePortalSignup(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ writePortalError(w, http.StatusMethodNotAllowed, "POST required")
+ return
+ }
+
+ var body struct {
+ Name string `json:"name"`
+ Email string `json:"email"`
+ Password string `json:"password"`
+ }
+ if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+ writePortalError(w, http.StatusBadRequest, "Invalid JSON")
+ return
+ }
+
+ // Validate required fields
+ body.Name = strings.TrimSpace(body.Name)
+ body.Email = strings.TrimSpace(body.Email)
+ if body.Name == "" || body.Email == "" || body.Password == "" {
+ writePortalError(w, http.StatusBadRequest, "Name, email, and password are required")
+ return
+ }
+ if len(body.Password) < 8 {
+ writePortalError(w, http.StatusBadRequest, "Password must be at least 8 characters")
+ return
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+ defer cancel()
+
+ // Check if login already exists
+ var exists bool
+ err := s.pool.QueryRow(ctx,
+ `SELECT EXISTS(SELECT 1 FROM res_users WHERE login = $1)`, body.Email).Scan(&exists)
+ if err != nil {
+ log.Printf("portal signup: check existing user error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Internal error")
+ return
+ }
+ if exists {
+ writePortalError(w, http.StatusConflict, "An account with this email already exists")
+ return
+ }
+
+ // Hash password
+ hashedPw, err := tools.HashPassword(body.Password)
+ if err != nil {
+ log.Printf("portal signup: hash password error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Internal error")
+ return
+ }
+
+ // Get default company
+ var companyID int64
+ err = s.pool.QueryRow(ctx,
+ `SELECT id FROM res_company WHERE active = true ORDER BY id LIMIT 1`).Scan(&companyID)
+ if err != nil {
+ log.Printf("portal signup: get company error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Internal error")
+ return
+ }
+
+ // Begin transaction β create partner + user atomically
+ tx, err := s.pool.Begin(ctx)
+ if err != nil {
+ log.Printf("portal signup: begin tx error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Internal error")
+ return
+ }
+ defer tx.Rollback(ctx)
+
+ // Create res.partner
+ var partnerID int64
+ err = tx.QueryRow(ctx,
+ `INSERT INTO res_partner (name, email, active, company_id, customer_rank)
+ VALUES ($1, $2, true, $3, 1)
+ RETURNING id`, body.Name, body.Email, companyID).Scan(&partnerID)
+ if err != nil {
+ log.Printf("portal signup: create partner error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to create account")
+ return
+ }
+
+ // Create res.users with share=true
+ var userID int64
+ err = tx.QueryRow(ctx,
+ `INSERT INTO res_users (login, password, active, partner_id, company_id, share)
+ VALUES ($1, $2, true, $3, $4, true)
+ RETURNING id`, body.Email, hashedPw, partnerID, companyID).Scan(&userID)
+ if err != nil {
+ log.Printf("portal signup: create user error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to create account")
+ return
+ }
+
+ // Add user to group_portal (not group_user)
+ var groupPortalID int64
+ err = tx.QueryRow(ctx,
+ `SELECT g.id FROM res_groups g
+ JOIN ir_model_data imd ON imd.res_id = g.id AND imd.model = 'res.groups'
+ WHERE imd.module = 'base' AND imd.name = 'group_portal'`).Scan(&groupPortalID)
+ if err != nil {
+ // group_portal might not exist yet β create it
+ err = tx.QueryRow(ctx,
+ `INSERT INTO res_groups (name) VALUES ('Portal') RETURNING id`).Scan(&groupPortalID)
+ if err != nil {
+ log.Printf("portal signup: create group_portal error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to create account")
+ return
+ }
+ _, err = tx.Exec(ctx,
+ `INSERT INTO ir_model_data (module, name, model, res_id)
+ VALUES ('base', 'group_portal', 'res.groups', $1)
+ ON CONFLICT DO NOTHING`, groupPortalID)
+ if err != nil {
+ log.Printf("portal signup: create group_portal xmlid error: %v", err)
+ }
+ }
+
+ _, err = tx.Exec(ctx,
+ `INSERT INTO res_groups_res_users_rel (res_groups_id, res_users_id)
+ VALUES ($1, $2) ON CONFLICT DO NOTHING`, groupPortalID, userID)
+ if err != nil {
+ log.Printf("portal signup: add user to group_portal error: %v", err)
+ }
+
+ if err := tx.Commit(ctx); err != nil {
+ log.Printf("portal signup: commit error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to create account")
+ return
+ }
+
+ log.Printf("portal signup: created portal user id=%d login=%s partner_id=%d",
+ userID, body.Email, partnerID)
+
+ writePortalJSON(w, map[string]interface{}{
+ "success": true,
+ "user_id": userID,
+ "partner_id": partnerID,
+ "message": "Account created successfully",
+ })
+}
+
+// handlePortalResetPassword handles password reset requests.
+// POST with {"email":"..."}: generates a reset token and sends an email.
+// POST with {"token":"...","password":"..."}: resets the password.
+// Mirrors: odoo/addons/auth_signup/controllers/main.py AuthSignupHome.web_auth_reset_password()
+func (s *Server) handlePortalResetPassword(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ writePortalError(w, http.StatusMethodNotAllowed, "POST required")
+ return
+ }
+
+ var body struct {
+ Email string `json:"email"`
+ Token string `json:"token"`
+ Password string `json:"password"`
+ }
+ if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+ writePortalError(w, http.StatusBadRequest, "Invalid JSON")
+ return
+ }
+
+ ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+ defer cancel()
+
+ // Phase 2: Token + new password β reset
+ if body.Token != "" && body.Password != "" {
+ s.handleResetWithToken(w, ctx, body.Token, body.Password)
+ return
+ }
+
+ // Phase 1: Email β generate token + send email
+ if body.Email == "" {
+ writePortalError(w, http.StatusBadRequest, "Email is required")
+ return
+ }
+
+ s.handleResetRequest(w, ctx, strings.TrimSpace(body.Email))
+}
+
+// handleResetRequest generates a reset token and sends it via email.
+func (s *Server) handleResetRequest(w http.ResponseWriter, ctx context.Context, email string) {
+ // Look up user
+ var uid int64
+ err := s.pool.QueryRow(ctx,
+ `SELECT id FROM res_users WHERE login = $1 AND active = true`, email).Scan(&uid)
+ if err != nil {
+ // Don't reveal whether the email exists β always return success
+ writePortalJSON(w, map[string]interface{}{
+ "success": true,
+ "message": "If an account exists with this email, a reset link has been sent",
+ })
+ return
+ }
+
+ // Generate token
+ tokenBytes := make([]byte, 32)
+ rand.Read(tokenBytes)
+ token := hex.EncodeToString(tokenBytes)
+ expiration := time.Now().Add(24 * time.Hour)
+
+ // Store token
+ _, err = s.pool.Exec(ctx,
+ `UPDATE res_users SET signup_token = $1, signup_expiration = $2 WHERE id = $3`,
+ token, expiration, uid)
+ if err != nil {
+ log.Printf("portal reset: store token error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Internal error")
+ return
+ }
+
+ // Send email with reset link
+ smtpCfg := tools.LoadSMTPConfig()
+ resetURL := fmt.Sprintf("/web/portal/reset_password?token=%s", token)
+ emailBody := fmt.Sprintf(`
+A password reset was requested for your account.
+Click the link below to set a new password:
+Reset Password
+This link expires in 24 hours.
+If you did not request this, you can ignore this email.
+`, resetURL)
+
+ if err := tools.SendEmail(smtpCfg, email, "Password Reset", emailBody); err != nil {
+ log.Printf("portal reset: send email error: %v", err)
+ // Don't expose email sending errors to the user
+ }
+
+ writePortalJSON(w, map[string]interface{}{
+ "success": true,
+ "message": "If an account exists with this email, a reset link has been sent",
+ })
+}
+
+// handleResetWithToken validates the token and sets the new password.
+func (s *Server) handleResetWithToken(w http.ResponseWriter, ctx context.Context, token, password string) {
+ if len(password) < 8 {
+ writePortalError(w, http.StatusBadRequest, "Password must be at least 8 characters")
+ return
+ }
+
+ // Look up user by token
+ var uid int64
+ var expiration time.Time
+ err := s.pool.QueryRow(ctx,
+ `SELECT id, signup_expiration FROM res_users
+ WHERE signup_token = $1 AND active = true`, token).Scan(&uid, &expiration)
+ if err != nil {
+ writePortalError(w, http.StatusBadRequest, "Invalid or expired reset token")
+ return
+ }
+
+ // Check expiration
+ if time.Now().After(expiration) {
+ // Clear expired token
+ s.pool.Exec(ctx,
+ `UPDATE res_users SET signup_token = NULL, signup_expiration = NULL WHERE id = $1`, uid)
+ writePortalError(w, http.StatusBadRequest, "Reset token has expired")
+ return
+ }
+
+ // Hash new password
+ hashedPw, err := tools.HashPassword(password)
+ if err != nil {
+ log.Printf("portal reset: hash password error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Internal error")
+ return
+ }
+
+ // Update password and clear token
+ _, err = s.pool.Exec(ctx,
+ `UPDATE res_users SET password = $1, signup_token = NULL, signup_expiration = NULL
+ WHERE id = $2`, hashedPw, uid)
+ if err != nil {
+ log.Printf("portal reset: update password error: %v", err)
+ writePortalError(w, http.StatusInternalServerError, "Failed to reset password")
+ return
+ }
+
+ log.Printf("portal reset: password reset for uid=%d", uid)
+
+ writePortalJSON(w, map[string]interface{}{
+ "success": true,
+ "message": "Password has been reset successfully",
+ })
+}
diff --git a/pkg/server/server.go b/pkg/server/server.go
index 15c6543..ab28b64 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -9,6 +9,7 @@ import (
"log"
"net/http"
"strings"
+ "sync"
"time"
"github.com/jackc/pgx/v5/pgxpool"
@@ -35,6 +36,8 @@ type Server struct {
// all JS files (except module_loader.js) plus the XML template bundle,
// served as a single file to avoid hundreds of individual HTTP requests.
jsBundle string
+
+ bus *Bus // Message bus for Discuss long-polling
}
// New creates a new server instance.
@@ -128,6 +131,17 @@ func (s *Server) registerRoutes() {
// CSV export
s.mux.HandleFunc("/web/export/csv", s.handleExportCSV)
+ s.mux.HandleFunc("/web/export/xlsx", s.handleExportXLSX)
+
+ // Import
+ s.mux.HandleFunc("/web/import/csv", s.handleImportCSV)
+
+ // Post-setup wizard
+ s.mux.HandleFunc("/web/setup/wizard", s.handleSetupWizard)
+ s.mux.HandleFunc("/web/setup/wizard/save", s.handleSetupWizardSave)
+
+ // Bank statement import
+ s.mux.HandleFunc("/web/bank_statement/import", s.handleBankStatementImport)
// Reports (HTML and PDF report rendering)
s.mux.HandleFunc("/report/", s.handleReport)
@@ -137,10 +151,16 @@ func (s *Server) registerRoutes() {
// Logout & Account
s.mux.HandleFunc("/web/session/logout", s.handleLogout)
s.mux.HandleFunc("/web/session/account", s.handleSessionAccount)
+ s.mux.HandleFunc("/web/session/switch_company", s.handleSwitchCompany)
// Health check
s.mux.HandleFunc("/health", s.handleHealth)
+ // Portal routes (external user access)
+ s.registerPortalRoutes()
+ s.registerPortalSignupRoutes()
+ s.registerBusRoutes()
+
// Static files (catch-all for //static/...)
// NOTE: must be last since it's a broad pattern
}
@@ -255,13 +275,14 @@ func (s *Server) handleCallKW(w http.ResponseWriter, r *http.Request) {
return
}
- // Extract UID from session, default to 1 (admin) if no session
- uid := int64(1)
- companyID := int64(1)
- if sess := GetSession(r); sess != nil {
- uid = sess.UID
- companyID = sess.CompanyID
+ // Extract UID from session β reject if no session (defense in depth)
+ sess := GetSession(r)
+ if sess == nil {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{Code: 100, Message: "Session expired"})
+ return
}
+ uid := sess.UID
+ companyID := sess.CompanyID
// Create environment for this request
env, err := orm.NewEnvironment(r.Context(), orm.EnvConfig{
@@ -294,6 +315,36 @@ func (s *Server) handleCallKW(w http.ResponseWriter, r *http.Request) {
s.writeJSONRPC(w, req.ID, result, nil)
}
+// sensitiveFields lists fields that only admin (uid=1) may write to.
+// Prevents privilege escalation via field manipulation.
+var sensitiveFields = map[string]map[string]bool{
+ "ir.cron": {"user_id": true, "model_name": true, "method_name": true},
+ "ir.model.access": {"group_id": true, "perm_read": true, "perm_write": true, "perm_create": true, "perm_unlink": true},
+ "ir.rule": {"domain_force": true, "groups": true, "perm_read": true, "perm_write": true, "perm_create": true, "perm_unlink": true},
+ "res.users": {"groups_id": true},
+ "res.groups": {"users": true},
+}
+
+// checkSensitiveFields blocks non-admin users from writing protected fields.
+func checkSensitiveFields(env *orm.Environment, model string, vals orm.Values) *RPCError {
+ if env.UID() == 1 || env.IsSuperuser() {
+ return nil
+ }
+ fields, ok := sensitiveFields[model]
+ if !ok {
+ return nil
+ }
+ for field := range vals {
+ if fields[field] {
+ return &RPCError{
+ Code: 403,
+ Message: fmt.Sprintf("Access Denied: field %q on %s is admin-only", field, model),
+ }
+ }
+ }
+ return nil
+}
+
// checkAccess verifies the current user has permission for the operation.
// Mirrors: odoo/addons/base/models/ir_model.py IrModelAccess.check()
func (s *Server) checkAccess(env *orm.Environment, model, method string) *RPCError {
@@ -317,8 +368,22 @@ func (s *Server) checkAccess(env *orm.Environment, model, method string) *RPCErr
`SELECT COUNT(*) FROM ir_model_access a
JOIN ir_model m ON m.id = a.model_id
WHERE m.model = $1`, model).Scan(&count)
- if err != nil || count == 0 {
- return nil // No ACLs defined β open access (like Odoo superuser mode)
+ if err != nil {
+ // DB error β deny access (fail-closed)
+ log.Printf("access: DB error checking ACL for model %s: %v", model, err)
+ return &RPCError{
+ Code: 403,
+ Message: fmt.Sprintf("Access Denied: %s on %s (internal error)", method, model),
+ }
+ }
+ if count == 0 {
+ // No ACL rules defined for this model β deny (fail-closed).
+ // All models should have ACL seed data via seedACLRules().
+ log.Printf("access: no ACL for model %s, denying (fail-closed)", model)
+ return &RPCError{
+ Code: 403,
+ Message: fmt.Sprintf("Access Denied: no ACL rules for %s", model),
+ }
}
// Check if user's groups grant permission
@@ -334,7 +399,11 @@ func (s *Server) checkAccess(env *orm.Environment, model, method string) *RPCErr
AND (a.group_id IS NULL OR gu.res_users_id = $2)
)`, perm), model, env.UID()).Scan(&granted)
if err != nil {
- return nil // On error, allow (fail-open for now)
+ log.Printf("access: DB error checking ACL grant for model %s: %v", model, err)
+ return &RPCError{
+ Code: 403,
+ Message: fmt.Sprintf("Access Denied: %s on %s (internal error)", method, model),
+ }
}
if !granted {
return &RPCError{
@@ -379,10 +448,57 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
switch params.Method {
case "has_group":
- // Always return true for admin user, stub for now
- return true, nil
+ // Check if current user belongs to the given group.
+ // Mirrors: odoo/orm/models.py BaseModel.user_has_groups()
+ groupXMLID := ""
+ if len(params.Args) > 0 {
+ groupXMLID, _ = params.Args[0].(string)
+ }
+ if groupXMLID == "" {
+ return false, nil
+ }
+ // Admin always has all groups
+ if env.UID() == 1 {
+ return true, nil
+ }
+ // Parse "module.xml_id" format
+ parts := strings.SplitN(groupXMLID, ".", 2)
+ if len(parts) != 2 {
+ return false, nil
+ }
+ // Query: does user belong to this group?
+ var exists bool
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT EXISTS(
+ SELECT 1 FROM res_groups_res_users_rel gur
+ JOIN ir_model_data imd ON imd.res_id = gur.res_groups_id AND imd.model = 'res.groups'
+ WHERE gur.res_users_id = $1 AND imd.module = $2 AND imd.name = $3
+ )`, env.UID(), parts[0], parts[1]).Scan(&exists)
+ if err != nil {
+ return false, nil
+ }
+ return exists, nil
case "check_access_rights":
+ // Check if current user has the given access right on this model.
+ // Mirrors: odoo/orm/models.py BaseModel.check_access_rights()
+ operation := "read"
+ if len(params.Args) > 0 {
+ if op, ok := params.Args[0].(string); ok {
+ operation = op
+ }
+ }
+ raiseException := true
+ if v, ok := params.KW["raise_exception"].(bool); ok {
+ raiseException = v
+ }
+ accessErr := s.checkAccess(env, params.Model, operation)
+ if accessErr != nil {
+ if raiseException {
+ return nil, accessErr
+ }
+ return false, nil
+ }
return true, nil
case "fields_get":
@@ -404,6 +520,11 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
vals := parseValuesAt(params.Args, 1)
spec, _ := params.KW["specification"].(map[string]interface{})
+ // Field-level access control
+ if err := checkSensitiveFields(env, params.Model, vals); err != nil {
+ return nil, err
+ }
+
if len(ids) > 0 && ids[0] > 0 {
// Update existing record(s)
err := rs.Browse(ids...).Write(vals)
@@ -513,6 +634,9 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
case "create":
vals := parseValues(params.Args)
+ if err := checkSensitiveFields(env, params.Model, vals); err != nil {
+ return nil, err
+ }
record, err := rs.Create(vals)
if err != nil {
return nil, &RPCError{Code: -32000, Message: err.Error()}
@@ -522,6 +646,9 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
case "write":
ids := parseIDs(params.Args)
vals := parseValuesAt(params.Args, 1)
+ if err := checkSensitiveFields(env, params.Model, vals); err != nil {
+ return nil, err
+ }
err := rs.Browse(ids...).Write(vals)
if err != nil {
return nil, &RPCError{Code: -32000, Message: err.Error()}
@@ -645,9 +772,33 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
}, nil
case "get_formview_id":
- return false, nil
+ // Return the default form view ID for this model.
+ // Mirrors: odoo/orm/models.py BaseModel.get_formview_id()
+ var viewID *int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT id FROM ir_ui_view
+ WHERE model = $1 AND type = 'form' AND active = true
+ ORDER BY priority, id LIMIT 1`,
+ params.Model).Scan(&viewID)
+ if err != nil || viewID == nil {
+ return false, nil
+ }
+ return *viewID, nil
case "action_get":
+ // Try registered method first (e.g. res.users has its own action_get).
+ // Mirrors: odoo/addons/base/models/res_users.py action_get()
+ model := orm.Registry.Get(params.Model)
+ if model != nil && model.Methods != nil {
+ if method, ok := model.Methods["action_get"]; ok {
+ ids := parseIDs(params.Args)
+ result, err := method(rs.Browse(ids...), params.Args[1:]...)
+ if err != nil {
+ return nil, &RPCError{Code: -32000, Message: err.Error()}
+ }
+ return result, nil
+ }
+ }
return false, nil
case "name_create":
@@ -665,10 +816,48 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
return []interface{}{created.ID(), nameStr}, nil
case "read_progress_bar":
- return map[string]interface{}{}, nil
+ return s.handleReadProgressBar(rs, params)
case "activity_format":
- return []interface{}{}, nil
+ ids := parseIDs(params.Args)
+ if len(ids) == 0 {
+ return []interface{}{}, nil
+ }
+ // Search activities for this model/record
+ actRS := env.Model("mail.activity")
+ var allActivities []orm.Values
+ for _, id := range ids {
+ domain := orm.And(
+ orm.Leaf("res_model", "=", params.Model),
+ orm.Leaf("res_id", "=", id),
+ orm.Leaf("done", "=", false),
+ )
+ found, err := actRS.Search(domain, orm.SearchOpts{Order: "date_deadline"})
+ if err != nil || found.IsEmpty() {
+ continue
+ }
+ records, err := found.Read([]string{"id", "res_model", "res_id", "activity_type_id", "summary", "note", "date_deadline", "user_id", "state"})
+ if err != nil {
+ continue
+ }
+ allActivities = append(allActivities, records...)
+ }
+ if allActivities == nil {
+ return []interface{}{}, nil
+ }
+ // Format M2O fields
+ actSpec := map[string]interface{}{
+ "activity_type_id": map[string]interface{}{},
+ "user_id": map[string]interface{}{},
+ }
+ formatM2OFields(env, "mail.activity", allActivities, actSpec)
+ formatDateFields("mail.activity", allActivities)
+ normalizeNullFields("mail.activity", allActivities)
+ actResult := make([]interface{}, len(allActivities))
+ for i, a := range allActivities {
+ actResult[i] = a
+ }
+ return actResult, nil
case "action_archive":
ids := parseIDs(params.Args)
@@ -697,6 +886,199 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
}
return created.ID(), nil
+ case "web_resequence":
+ // Resequence records by their IDs (drag&drop reordering).
+ // Mirrors: odoo/addons/web/models/models.py web_resequence()
+ ids := parseIDs(params.Args)
+ if len(ids) == 0 {
+ return []orm.Values{}, nil
+ }
+
+ // Parse field_name (default "sequence")
+ fieldName := "sequence"
+ if v, ok := params.KW["field_name"].(string); ok {
+ fieldName = v
+ }
+
+ // Parse offset (default 0)
+ offset := 0
+ if v, ok := params.KW["offset"].(float64); ok {
+ offset = int(v)
+ }
+
+ // Check if field exists on the model
+ model := orm.Registry.Get(params.Model)
+ if model == nil || model.GetField(fieldName) == nil {
+ return []orm.Values{}, nil
+ }
+
+ // Update sequence for each record in order
+ for i, id := range ids {
+ if err := rs.Browse(id).Write(orm.Values{fieldName: offset + i}); err != nil {
+ return nil, &RPCError{Code: -32000, Message: err.Error()}
+ }
+ }
+
+ // Return records via web_read
+ spec, _ := params.KW["specification"].(map[string]interface{})
+ readParams := CallKWParams{
+ Model: params.Model,
+ Method: "web_read",
+ Args: []interface{}{ids},
+ KW: map[string]interface{}{"specification": spec},
+ }
+ return handleWebRead(env, params.Model, readParams)
+
+ case "message_post":
+ // Post a message on the record's chatter.
+ // Mirrors: odoo/addons/mail/models/mail_thread.py message_post()
+ ids := parseIDs(params.Args)
+ if len(ids) == 0 {
+ return false, nil
+ }
+
+ body, _ := params.KW["body"].(string)
+ messageType := "comment"
+ if v, _ := params.KW["message_type"].(string); v != "" {
+ messageType = v
+ }
+
+ // Get author from current user's partner_id
+ var authorID int64
+ if err := env.Tx().QueryRow(env.Ctx(),
+ `SELECT partner_id FROM res_users WHERE id = $1`, env.UID(),
+ ).Scan(&authorID); err != nil {
+ log.Printf("warning: message_post author lookup failed: %v", err)
+ }
+
+ // Create mail.message linked to the current model/record
+ var msgID int64
+ err := env.Tx().QueryRow(env.Ctx(),
+ `INSERT INTO mail_message (model, res_id, body, message_type, author_id, date, create_uid, write_uid, create_date, write_date)
+ VALUES ($1, $2, $3, $4, $5, NOW(), $6, $6, NOW(), NOW())
+ RETURNING id`,
+ params.Model, ids[0], body, messageType, authorID, env.UID(),
+ ).Scan(&msgID)
+ if err != nil {
+ return nil, &RPCError{Code: -32000, Message: err.Error()}
+ }
+ return msgID, nil
+
+ case "_message_get_thread":
+ // Get messages for a record's chatter.
+ // Mirrors: odoo/addons/mail/models/mail_thread.py
+ ids := parseIDs(params.Args)
+ if len(ids) == 0 {
+ return []interface{}{}, nil
+ }
+
+ rows, err := env.Tx().Query(env.Ctx(),
+ `SELECT m.id, m.body, m.message_type, m.date,
+ m.author_id, COALESCE(p.name, ''),
+ COALESCE(m.subject, ''), COALESCE(m.email_from, '')
+ FROM mail_message m
+ LEFT JOIN res_partner p ON p.id = m.author_id
+ WHERE m.model = $1 AND m.res_id = $2
+ ORDER BY m.id DESC`,
+ params.Model, ids[0],
+ )
+ if err != nil {
+ return nil, &RPCError{Code: -32000, Message: err.Error()}
+ }
+ defer rows.Close()
+
+ var messages []map[string]interface{}
+ for rows.Next() {
+ var id int64
+ var body, msgType, subject, emailFrom string
+ var date interface{}
+ var authorID int64
+ var authorName string
+
+ if scanErr := rows.Scan(&id, &body, &msgType, &date, &authorID, &authorName, &subject, &emailFrom); scanErr != nil {
+ continue
+ }
+ msg := map[string]interface{}{
+ "id": id,
+ "body": body,
+ "message_type": msgType,
+ "date": date,
+ "subject": subject,
+ "email_from": emailFrom,
+ }
+ if authorID > 0 {
+ msg["author_id"] = []interface{}{authorID, authorName}
+ } else {
+ msg["author_id"] = false
+ }
+ messages = append(messages, msg)
+ }
+ if messages == nil {
+ messages = []map[string]interface{}{}
+ }
+ return messages, nil
+
+ case "read_followers":
+ ids := parseIDs(params.Args)
+ if len(ids) == 0 {
+ return []interface{}{}, nil
+ }
+ // Search followers for this model/record
+ followerRS := env.Model("mail.followers")
+ domain := orm.And(
+ orm.Leaf("res_model", "=", params.Model),
+ orm.Leaf("res_id", "in", ids),
+ )
+ found, err := followerRS.Search(domain, orm.SearchOpts{Limit: 100})
+ if err != nil || found.IsEmpty() {
+ return []interface{}{}, nil
+ }
+ followerRecords, err := found.Read([]string{"id", "res_model", "res_id", "partner_id"})
+ if err != nil {
+ return []interface{}{}, nil
+ }
+ followerSpec := map[string]interface{}{"partner_id": map[string]interface{}{}}
+ formatM2OFields(env, "mail.followers", followerRecords, followerSpec)
+ normalizeNullFields("mail.followers", followerRecords)
+ followerResult := make([]interface{}, len(followerRecords))
+ for i, r := range followerRecords {
+ followerResult[i] = r
+ }
+ return followerResult, nil
+
+ case "get_activity_data":
+ // Return activity summary data for records.
+ // Mirrors: odoo/addons/mail/models/mail_activity_mixin.py
+ emptyResult := map[string]interface{}{
+ "activity_types": []interface{}{},
+ "activity_res_ids": map[string]interface{}{},
+ "grouped_activities": map[string]interface{}{},
+ }
+
+ ids := parseIDs(params.Args)
+ if len(ids) == 0 {
+ return emptyResult, nil
+ }
+
+ // Get activity types
+ typeRS := env.Model("mail.activity.type")
+ types, err := typeRS.Search(nil, orm.SearchOpts{Order: "sequence, id"})
+ if err != nil || types.IsEmpty() {
+ return emptyResult, nil
+ }
+ typeRecords, _ := types.Read([]string{"id", "name"})
+
+ typeList := make([]interface{}, len(typeRecords))
+ for i, t := range typeRecords {
+ typeList[i] = t
+ }
+
+ return map[string]interface{}{
+ "activity_types": typeList,
+ "activity_res_ids": map[string]interface{}{},
+ "grouped_activities": map[string]interface{}{},
+ }, nil
+
default:
// Try registered business methods on the model.
// Mirrors: odoo/service/model.py call_kw() + odoo/addons/web/controllers/dataset.py call_button()
@@ -732,6 +1114,58 @@ func (s *Server) dispatchORM(env *orm.Environment, params CallKWParams) (interfa
// --- Session / Auth Endpoints ---
+// loginAttemptInfo tracks login attempts for rate limiting.
+type loginAttemptInfo struct {
+ Count int
+ LastTime time.Time
+}
+
+var (
+ loginAttempts = make(map[string]loginAttemptInfo)
+ loginAttemptsMu sync.Mutex
+)
+
+// checkLoginRateLimit returns false if the login is rate-limited (too many attempts).
+func (s *Server) checkLoginRateLimit(login string) bool {
+ loginAttemptsMu.Lock()
+ defer loginAttemptsMu.Unlock()
+
+ now := time.Now()
+
+ // Periodic cleanup: evict stale entries (>15 min old) to prevent unbounded growth
+ if len(loginAttempts) > 100 {
+ for k, v := range loginAttempts {
+ if now.Sub(v.LastTime) > 15*time.Minute {
+ delete(loginAttempts, k)
+ }
+ }
+ }
+
+ info := loginAttempts[login]
+
+ // Reset after 15 minutes
+ if now.Sub(info.LastTime) > 15*time.Minute {
+ info = loginAttemptInfo{}
+ }
+
+ // Max 10 attempts per 15 minutes
+ if info.Count >= 10 {
+ return false // Rate limited
+ }
+
+ info.Count++
+ info.LastTime = now
+ loginAttempts[login] = info
+ return true
+}
+
+// resetLoginRateLimit clears the rate limit counter on successful login.
+func (s *Server) resetLoginRateLimit(login string) {
+ loginAttemptsMu.Lock()
+ defer loginAttemptsMu.Unlock()
+ delete(loginAttempts, login)
+}
+
func (s *Server) handleAuthenticate(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
@@ -754,6 +1188,14 @@ func (s *Server) handleAuthenticate(w http.ResponseWriter, r *http.Request) {
return
}
+ // Rate limit login attempts
+ if !s.checkLoginRateLimit(params.Login) {
+ s.writeJSONRPC(w, req.ID, nil, &RPCError{
+ Code: 429, Message: "Too many login attempts. Please try again later.",
+ })
+ return
+ }
+
// Query user by login
var uid int64
var companyID int64
@@ -776,16 +1218,40 @@ func (s *Server) handleAuthenticate(w http.ResponseWriter, r *http.Request) {
return
}
- // Check password (support both bcrypt and plaintext for migration)
- if !tools.CheckPassword(hashedPw, params.Password) && hashedPw != params.Password {
+ // Check password (bcrypt only β no plaintext fallback)
+ if !tools.CheckPassword(hashedPw, params.Password) {
s.writeJSONRPC(w, req.ID, nil, &RPCError{
Code: 100, Message: "Access Denied: invalid login or password",
})
return
}
+ // Successful login β reset rate limiter
+ s.resetLoginRateLimit(params.Login)
+
+ // Query allowed companies for the user
+ allowedCompanyIDs := []int64{companyID}
+ rows, err := s.pool.Query(r.Context(),
+ `SELECT DISTINCT c.id FROM res_company c
+ WHERE c.active = true
+ ORDER BY c.id`)
+ if err == nil {
+ defer rows.Close()
+ var ids []int64
+ for rows.Next() {
+ var cid int64
+ if rows.Scan(&cid) == nil {
+ ids = append(ids, cid)
+ }
+ }
+ if len(ids) > 0 {
+ allowedCompanyIDs = ids
+ }
+ }
+
// Create session
sess := s.sessions.New(uid, companyID, params.Login)
+ sess.AllowedCompanyIDs = allowedCompanyIDs
// Set session cookie
http.SetCookie(w, &http.Cookie{
@@ -793,6 +1259,7 @@ func (s *Server) handleAuthenticate(w http.ResponseWriter, r *http.Request) {
Value: sess.ID,
Path: "/",
HttpOnly: true,
+ Secure: true,
SameSite: http.SameSiteLaxMode,
})
@@ -857,6 +1324,7 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
Path: "/",
MaxAge: -1,
HttpOnly: true,
+ Secure: true,
})
http.Redirect(w, r, "/web/login", http.StatusFound)
}
diff --git a/pkg/server/session.go b/pkg/server/session.go
index 35da29a..8ec9fb5 100644
--- a/pkg/server/session.go
+++ b/pkg/server/session.go
@@ -13,12 +13,14 @@ import (
// Session represents an authenticated user session.
type Session struct {
- ID string
- UID int64
- CompanyID int64
- Login string
- CreatedAt time.Time
- LastActivity time.Time
+ ID string
+ UID int64
+ CompanyID int64
+ AllowedCompanyIDs []int64
+ Login string
+ CSRFToken string
+ CreatedAt time.Time
+ LastActivity time.Time
}
// SessionStore is a session store with an in-memory cache backed by PostgreSQL.
@@ -47,10 +49,15 @@ func InitSessionTable(ctx context.Context, pool *pgxpool.Pool) error {
uid INT8 NOT NULL,
company_id INT8 NOT NULL,
login VARCHAR(255),
+ csrf_token VARCHAR(64) DEFAULT '',
created_at TIMESTAMP DEFAULT NOW(),
last_seen TIMESTAMP DEFAULT NOW()
)
`)
+ if err == nil {
+ // Add csrf_token column if table already exists without it
+ pool.Exec(ctx, `ALTER TABLE sessions ADD COLUMN IF NOT EXISTS csrf_token VARCHAR(64) DEFAULT ''`)
+ }
if err != nil {
return err
}
@@ -67,6 +74,7 @@ func (s *SessionStore) New(uid, companyID int64, login string) *Session {
UID: uid,
CompanyID: companyID,
Login: login,
+ CSRFToken: generateToken(),
CreatedAt: now,
LastActivity: now,
}
@@ -81,10 +89,10 @@ func (s *SessionStore) New(uid, companyID int64, login string) *Session {
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
_, err := s.pool.Exec(ctx,
- `INSERT INTO sessions (id, uid, company_id, login, created_at, last_seen)
- VALUES ($1, $2, $3, $4, $5, $6)
+ `INSERT INTO sessions (id, uid, company_id, login, csrf_token, created_at, last_seen)
+ VALUES ($1, $2, $3, $4, $5, $6, $7)
ON CONFLICT (id) DO NOTHING`,
- token, uid, companyID, login, now, now)
+ token, uid, companyID, login, sess.CSRFToken, now, now)
if err != nil {
log.Printf("session: failed to persist session to DB: %v", err)
}
@@ -106,20 +114,23 @@ func (s *SessionStore) Get(id string) *Session {
s.Delete(id)
return nil
}
- // Update last activity
+
now := time.Now()
+ needsDBUpdate := time.Since(sess.LastActivity) > 30*time.Second
+
+ // Update last activity in memory
s.mu.Lock()
sess.LastActivity = now
s.mu.Unlock()
- // Update last_seen in DB asynchronously
- if s.pool != nil {
- go func() {
- ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
- defer cancel()
- s.pool.Exec(ctx,
- `UPDATE sessions SET last_seen = $1 WHERE id = $2`, now, id)
- }()
+ // Throttle DB writes: only persist every 30s to avoid per-request overhead
+ if needsDBUpdate && s.pool != nil {
+ ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+ defer cancel()
+ if _, err := s.pool.Exec(ctx,
+ `UPDATE sessions SET last_seen = $1 WHERE id = $2`, now, id); err != nil {
+ log.Printf("session: failed to update last_seen in DB: %v", err)
+ }
}
return sess
@@ -134,14 +145,20 @@ func (s *SessionStore) Get(id string) *Session {
defer cancel()
sess = &Session{}
+ var csrfToken string
err := s.pool.QueryRow(ctx,
- `SELECT id, uid, company_id, login, created_at, last_seen
+ `SELECT id, uid, company_id, login, COALESCE(csrf_token, ''), created_at, last_seen
FROM sessions WHERE id = $1`, id).Scan(
- &sess.ID, &sess.UID, &sess.CompanyID, &sess.Login,
+ &sess.ID, &sess.UID, &sess.CompanyID, &sess.Login, &csrfToken,
&sess.CreatedAt, &sess.LastActivity)
if err != nil {
return nil
}
+ if csrfToken != "" {
+ sess.CSRFToken = csrfToken
+ } else {
+ sess.CSRFToken = generateToken()
+ }
// Check TTL
if time.Since(sess.LastActivity) > s.ttl {
@@ -149,18 +166,18 @@ func (s *SessionStore) Get(id string) *Session {
return nil
}
- // Update last activity
+ // Update last activity and add to memory cache
now := time.Now()
- sess.LastActivity = now
-
- // Add to memory cache
s.mu.Lock()
+ sess.LastActivity = now
s.sessions[id] = sess
s.mu.Unlock()
// Update last_seen in DB
- s.pool.Exec(ctx,
- `UPDATE sessions SET last_seen = $1 WHERE id = $2`, now, id)
+ if _, err := s.pool.Exec(ctx,
+ `UPDATE sessions SET last_seen = $1 WHERE id = $2`, now, id); err != nil {
+ log.Printf("session: failed to update last_seen in DB: %v", err)
+ }
return sess
}
diff --git a/pkg/server/setup.go b/pkg/server/setup.go
index 4286783..e1cd4ff 100644
--- a/pkg/server/setup.go
+++ b/pkg/server/setup.go
@@ -6,14 +6,17 @@ import (
"fmt"
"log"
"net/http"
+ "os"
"regexp"
"strings"
+ "sync/atomic"
"time"
"odoo-go/pkg/service"
"odoo-go/pkg/tools"
)
+
var dbnamePattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_.-]+$`)
// isSetupNeeded checks if the current database has been initialized.
@@ -55,6 +58,16 @@ func (s *Server) handleDatabaseCreate(w http.ResponseWriter, r *http.Request) {
return
}
+ // Validate master password (default: "admin", configurable via ODOO_MASTER_PASSWORD env)
+ masterPw := os.Getenv("ODOO_MASTER_PASSWORD")
+ if masterPw == "" {
+ masterPw = "admin"
+ }
+ if params.MasterPwd != masterPw {
+ writeJSON(w, map[string]string{"error": "Invalid master password"})
+ return
+ }
+
// Validate
if params.Login == "" || params.Password == "" {
writeJSON(w, map[string]string{"error": "Email and password are required"})
@@ -111,7 +124,10 @@ func (s *Server) handleDatabaseCreate(w http.ResponseWriter, r *http.Request) {
domain := parts[1]
domainParts := strings.Split(domain, ".")
if len(domainParts) > 0 {
- companyName = strings.Title(domainParts[0])
+ name := domainParts[0]
+ if len(name) > 0 {
+ companyName = strings.ToUpper(name[:1]) + name[1:]
+ }
}
}
}
@@ -175,6 +191,195 @@ func writeJSON(w http.ResponseWriter, v interface{}) {
json.NewEncoder(w).Encode(v)
}
+// postSetupDone caches the result of isPostSetupNeeded to avoid a DB query on every request.
+var postSetupDone atomic.Bool
+
+// isPostSetupNeeded checks if the company still has default values (needs configuration).
+func (s *Server) isPostSetupNeeded() bool {
+ if postSetupDone.Load() {
+ return false
+ }
+ var name string
+ err := s.pool.QueryRow(context.Background(),
+ `SELECT COALESCE(name, '') FROM res_company WHERE id = 1`).Scan(&name)
+ if err != nil {
+ return false
+ }
+ needed := name == "" || name == "My Company" || strings.HasPrefix(name, "My ")
+ if !needed {
+ postSetupDone.Store(true)
+ }
+ return needed
+}
+
+// handleSetupWizard serves the post-setup configuration wizard.
+// Shown after first login when the company has not been configured yet.
+// Mirrors: odoo/addons/base_setup/views/res_config_settings_views.xml
+func (s *Server) handleSetupWizard(w http.ResponseWriter, r *http.Request) {
+ sess := GetSession(r)
+ if sess == nil {
+ http.Redirect(w, r, "/web/login", http.StatusFound)
+ return
+ }
+
+ // Load current company data
+ var companyName, street, city, zip, phone, email, website, vat string
+ var countryID int64
+ s.pool.QueryRow(context.Background(),
+ `SELECT COALESCE(name,''), COALESCE(street,''), COALESCE(city,''), COALESCE(zip,''),
+ COALESCE(phone,''), COALESCE(email,''), COALESCE(website,''), COALESCE(vat,''),
+ COALESCE(country_id, 0)
+ FROM res_company WHERE id = $1`, sess.CompanyID,
+ ).Scan(&companyName, &street, &city, &zip, &phone, &email, &website, &vat, &countryID)
+
+ w.Header().Set("Content-Type", "text/html; charset=utf-8")
+ esc := htmlEscape
+ fmt.Fprintf(w, setupWizardHTML,
+ esc(companyName), esc(street), esc(city), esc(zip), esc(phone), esc(email), esc(website), esc(vat))
+}
+
+// handleSetupWizardSave saves the post-setup wizard data.
+func (s *Server) handleSetupWizardSave(w http.ResponseWriter, r *http.Request) {
+ sess := GetSession(r)
+ if sess == nil {
+ writeJSON(w, map[string]string{"error": "Not authenticated"})
+ return
+ }
+
+ var params struct {
+ CompanyName string `json:"company_name"`
+ Street string `json:"street"`
+ City string `json:"city"`
+ Zip string `json:"zip"`
+ Phone string `json:"phone"`
+ Email string `json:"email"`
+ Website string `json:"website"`
+ Vat string `json:"vat"`
+ }
+ if err := json.NewDecoder(r.Body).Decode(¶ms); err != nil {
+ writeJSON(w, map[string]string{"error": "Invalid request"})
+ return
+ }
+
+ if params.CompanyName == "" {
+ writeJSON(w, map[string]string{"error": "Company name is required"})
+ return
+ }
+
+ _, err := s.pool.Exec(context.Background(),
+ `UPDATE res_company SET name=$1, street=$2, city=$3, zip=$4, phone=$5, email=$6, website=$7, vat=$8
+ WHERE id = $9`,
+ params.CompanyName, params.Street, params.City, params.Zip,
+ params.Phone, params.Email, params.Website, params.Vat, sess.CompanyID)
+ if err != nil {
+ writeJSON(w, map[string]string{"error": fmt.Sprintf("Save error: %v", err)})
+ return
+ }
+
+ // Also update the partner linked to the company
+ s.pool.Exec(context.Background(),
+ `UPDATE res_partner SET name=$1, street=$2, city=$3, zip=$4, phone=$5, email=$6, website=$7, vat=$8
+ WHERE id = (SELECT partner_id FROM res_company WHERE id = $9)`,
+ params.CompanyName, params.Street, params.City, params.Zip,
+ params.Phone, params.Email, params.Website, params.Vat, sess.CompanyID)
+
+ postSetupDone.Store(true) // Mark setup as done so we don't redirect again
+ writeJSON(w, map[string]interface{}{"status": "ok", "redirect": "/odoo"})
+}
+
+var setupWizardHTML = `
+
+
+
+
+ Setup β Configure Your Company
+
+
+
+
+
Configure Your Company
+
Set up your company information
+
+
+
+
+
+
+
+`, nameField)
+}
+
+// generateDefaultDashboardView creates a dashboard view with aggregate widgets.
+// Mirrors: odoo/addons/board/static/src/board_view.js
+func generateDefaultDashboardView(m *orm.Model) string {
+ var widgets []string
+
+ // Add aggregate widgets for numeric fields
+ for _, name := range sortedFieldNames(m) {
+ f := m.GetField(name)
+ if f == nil {
+ continue
+ }
+ if (f.Type == orm.TypeFloat || f.Type == orm.TypeInteger || f.Type == orm.TypeMonetary) &&
+ f.IsStored() && f.Name != "id" && f.Name != "sequence" &&
+ f.Name != "create_uid" && f.Name != "write_uid" && f.Name != "company_id" {
+ widgets = append(widgets, fmt.Sprintf(
+ ` `,
+ f.Name, f.Name, f.String))
+ if len(widgets) >= 6 {
+ break
+ }
+ }
+ }
+
+ // Add a graph for the first groupable dimension
+ var graphField string
+ for _, name := range sortedFieldNames(m) {
+ f := m.GetField(name)
+ if f != nil && f.IsStored() && (f.Type == orm.TypeMany2one || f.Type == orm.TypeSelection) {
+ graphField = name
+ break
+ }
+ }
+
+ var buf strings.Builder
+ buf.WriteString("\n")
+ if len(widgets) > 0 {
+ buf.WriteString(" \n")
+ for _, w := range widgets {
+ buf.WriteString(w + "\n")
+ }
+ buf.WriteString(" \n")
+ }
+ if graphField != "" {
+ buf.WriteString(fmt.Sprintf(`
+
+
+
+
+`, graphField))
+ }
+ buf.WriteString("")
+ return buf.String()
+}
+
// sortedFieldNames returns field names in alphabetical order for deterministic output.
func sortedFieldNames(m *orm.Model) []string {
fields := m.Fields()
diff --git a/pkg/server/web_methods.go b/pkg/server/web_methods.go
index 5e87a79..6328a7e 100644
--- a/pkg/server/web_methods.go
+++ b/pkg/server/web_methods.go
@@ -2,6 +2,7 @@ package server
import (
"fmt"
+ "strings"
"time"
"odoo-go/pkg/orm"
@@ -451,6 +452,110 @@ func (s *Server) handleReadGroup(rs *orm.Recordset, params CallKWParams) (interf
}
if params.Method == "web_read_group" {
+ // --- __fold support ---
+ // If the first groupby is a Many2one whose comodel has a "fold" field,
+ // add __fold to each group. Mirrors: odoo/addons/web/models/models.py
+ if len(groupby) > 0 {
+ fieldName := strings.SplitN(groupby[0], ":", 2)[0]
+ m := rs.ModelDef()
+ if m != nil {
+ f := m.GetField(fieldName)
+ if f != nil && f.Type == orm.TypeMany2one && f.Comodel != "" {
+ comodel := orm.Registry.Get(f.Comodel)
+ if comodel != nil && comodel.GetField("fold") != nil {
+ addFoldInfo(rs.Env(), f.Comodel, groupby[0], groups)
+ }
+ }
+ }
+ }
+
+ // --- __records for auto_unfold ---
+ autoUnfold := false
+ if v, ok := params.KW["auto_unfold"].(bool); ok {
+ autoUnfold = v
+ }
+ if autoUnfold {
+ unfoldReadSpec, _ := params.KW["unfold_read_specification"].(map[string]interface{})
+ unfoldLimit := defaultWebSearchLimit
+ if v, ok := params.KW["unfold_read_default_limit"].(float64); ok {
+ unfoldLimit = int(v)
+ }
+
+ // Parse original domain for combining with group domain
+ origDomain := parseDomain(params.Args)
+ if origDomain == nil {
+ if dr, ok := params.KW["domain"].([]interface{}); ok && len(dr) > 0 {
+ origDomain = parseDomain([]interface{}{dr})
+ }
+ }
+
+ modelName := rs.ModelDef().Name()
+ maxUnfolded := 10
+ unfolded := 0
+ for _, g := range groups {
+ if unfolded >= maxUnfolded {
+ break
+ }
+ gm := g.(map[string]interface{})
+ fold, _ := gm["__fold"].(bool)
+ count, _ := gm["__count"].(int64)
+ // Skip folded, empty, and groups with false/nil M2O value
+ // Mirrors: odoo/addons/web/models/models.py _open_groups() fold checks
+ if fold || count == 0 {
+ continue
+ }
+ // For M2O groupby: skip groups where the value is false (unset M2O)
+ if len(groupby) > 0 {
+ gbVal := gm[groupby[0]]
+ if gbVal == nil || gbVal == false {
+ continue
+ }
+ }
+
+ // Build combined domain: original + group extra domain
+ var combinedDomain orm.Domain
+ if origDomain != nil {
+ combinedDomain = append(combinedDomain, origDomain...)
+ }
+ if extraDom, ok := gm["__extra_domain"].([]interface{}); ok && len(extraDom) > 0 {
+ groupDomain := parseDomain([]interface{}{extraDom})
+ combinedDomain = append(combinedDomain, groupDomain...)
+ }
+
+ found, err := rs.Env().Model(modelName).Search(combinedDomain, orm.SearchOpts{Limit: unfoldLimit})
+ if err != nil || found.IsEmpty() {
+ gm["__records"] = []orm.Values{}
+ unfolded++
+ continue
+ }
+
+ fields := specToFields(unfoldReadSpec)
+ if len(fields) == 0 {
+ fields = []string{"id"}
+ }
+ hasID := false
+ for _, f := range fields {
+ if f == "id" {
+ hasID = true
+ break
+ }
+ }
+ if !hasID {
+ fields = append([]string{"id"}, fields...)
+ }
+
+ records, err := found.Read(fields)
+ if err != nil {
+ gm["__records"] = []orm.Values{}
+ unfolded++
+ continue
+ }
+ formatRecordsForWeb(rs.Env(), modelName, records, unfoldReadSpec)
+ gm["__records"] = records
+ unfolded++
+ }
+ }
+
// web_read_group: also get total group count (without limit/offset)
totalLen := len(results)
if opts.Limit > 0 || opts.Offset > 0 {
@@ -470,6 +575,203 @@ func (s *Server) handleReadGroup(rs *orm.Recordset, params CallKWParams) (interf
return groups, nil
}
+// handleReadProgressBar returns per-group counts for a progress bar field.
+// Mirrors: odoo/orm/models.py BaseModel._read_progress_bar()
+//
+// Called by the kanban view to render colored progress bars per column.
+// Input (via KW):
+//
+// domain: search filter
+// group_by: field to group columns by (e.g. "stage_id")
+// progress_bar: {field: "kanban_state", colors: {"done": "success", ...}}
+//
+// Output:
+//
+// {groupByValue: {pbValue: count, ...}, ...}
+//
+// Where groupByValue is the raw DB value (integer ID for M2O, string for
+// selection, "True"/"False" for boolean).
+func (s *Server) handleReadProgressBar(rs *orm.Recordset, params CallKWParams) (interface{}, *RPCError) {
+ // Parse domain from KW
+ domain := parseDomain(params.Args)
+ if domain == nil {
+ if dr, ok := params.KW["domain"].([]interface{}); ok && len(dr) > 0 {
+ domain = parseDomain([]interface{}{dr})
+ }
+ }
+
+ // Parse group_by (single string)
+ groupBy := ""
+ if v, ok := params.KW["group_by"].(string); ok {
+ groupBy = v
+ }
+
+ // Parse progress_bar map
+ progressBar, _ := params.KW["progress_bar"].(map[string]interface{})
+ pbField, _ := progressBar["field"].(string)
+
+ if groupBy == "" || pbField == "" {
+ return map[string]interface{}{}, nil
+ }
+
+ // Use ReadGroup with two groupby levels: [groupBy, pbField]
+ results, err := rs.ReadGroup(domain, []string{groupBy, pbField}, []string{"__count"})
+ if err != nil {
+ return map[string]interface{}{}, nil
+ }
+
+ // Determine field types for key formatting
+ m := rs.ModelDef()
+ gbField := m.GetField(groupBy)
+ pbFieldDef := m.GetField(pbField)
+
+ // Build nested map: {groupByValue: {pbValue: count}}
+ data := make(map[string]interface{})
+
+ // Collect all known progress bar values (from colors) so we initialize zeros
+ pbColors, _ := progressBar["colors"].(map[string]interface{})
+
+ for _, r := range results {
+ // Format the group-by key
+ gbVal := r.GroupValues[groupBy]
+ gbKey := formatProgressBarKey(gbVal, gbField)
+
+ // Format the progress bar value
+ pbVal := r.GroupValues[pbField]
+ pbKey := formatProgressBarValue(pbVal, pbFieldDef)
+
+ // Initialize group entry with zero counts if first time
+ if _, exists := data[gbKey]; !exists {
+ entry := make(map[string]interface{})
+ for colorKey := range pbColors {
+ entry[colorKey] = 0
+ }
+ data[gbKey] = entry
+ }
+
+ // Add count
+ entry := data[gbKey].(map[string]interface{})
+ existing, _ := entry[pbKey].(int)
+ entry[pbKey] = existing + int(r.Count)
+ }
+
+ return data, nil
+}
+
+// formatProgressBarKey formats a group-by value as the string key expected
+// by the frontend progress bar.
+// - M2O: integer ID (as string)
+// - Boolean: "True" / "False"
+// - nil/false: "False"
+// - Other: value as string
+func formatProgressBarKey(val interface{}, f *orm.Field) string {
+ if val == nil || val == false {
+ return "False"
+ }
+
+ // M2O: ReadGroup resolves to [id, name] pair β use the id
+ if f != nil && f.Type == orm.TypeMany2one {
+ switch v := val.(type) {
+ case []interface{}:
+ if len(v) > 0 {
+ return fmt.Sprintf("%v", v[0])
+ }
+ return "False"
+ case int64:
+ return fmt.Sprintf("%d", v)
+ case float64:
+ return fmt.Sprintf("%d", int64(v))
+ case int:
+ return fmt.Sprintf("%d", v)
+ }
+ }
+
+ // Boolean
+ if f != nil && f.Type == orm.TypeBoolean {
+ switch v := val.(type) {
+ case bool:
+ if v {
+ return "True"
+ }
+ return "False"
+ }
+ }
+
+ return fmt.Sprintf("%v", val)
+}
+
+// formatProgressBarValue formats a progress bar field value as a string key.
+// Selection fields use the raw value (e.g. "done", "blocked").
+// Boolean fields use "True"/"False".
+func formatProgressBarValue(val interface{}, f *orm.Field) string {
+ if val == nil || val == false {
+ return "False"
+ }
+ if f != nil && f.Type == orm.TypeBoolean {
+ switch v := val.(type) {
+ case bool:
+ if v {
+ return "True"
+ }
+ return "False"
+ }
+ }
+ return fmt.Sprintf("%v", val)
+}
+
+// addFoldInfo reads the "fold" boolean from the comodel records referenced
+// by each group and sets __fold on the group maps accordingly.
+func addFoldInfo(env *orm.Environment, comodel string, groupbySpec string, groups []interface{}) {
+ // Collect IDs from group values (M2O pairs like [id, name])
+ var ids []int64
+ for _, g := range groups {
+ gm := g.(map[string]interface{})
+ val := gm[groupbySpec]
+ if pair, ok := val.([]interface{}); ok && len(pair) >= 1 {
+ if id, ok := orm.ToRecordID(pair[0]); ok && id > 0 {
+ ids = append(ids, id)
+ }
+ }
+ }
+ if len(ids) == 0 {
+ // All groups have false/empty value β fold them by default
+ for _, g := range groups {
+ gm := g.(map[string]interface{})
+ gm["__fold"] = false
+ }
+ return
+ }
+
+ // Read fold values from comodel
+ rs := env.Model(comodel).Browse(ids...)
+ records, err := rs.Read([]string{"id", "fold"})
+ if err != nil {
+ return
+ }
+
+ // Build fold map
+ foldMap := make(map[int64]bool)
+ for _, rec := range records {
+ id, _ := orm.ToRecordID(rec["id"])
+ fold, _ := rec["fold"].(bool)
+ foldMap[id] = fold
+ }
+
+ // Apply to groups
+ for _, g := range groups {
+ gm := g.(map[string]interface{})
+ val := gm[groupbySpec]
+ if pair, ok := val.([]interface{}); ok && len(pair) >= 1 {
+ if id, ok := orm.ToRecordID(pair[0]); ok {
+ gm["__fold"] = foldMap[id]
+ }
+ } else {
+ // false/empty group value
+ gm["__fold"] = false
+ }
+ }
+}
+
// formatDateFields converts date/datetime values to Odoo's expected string format.
func formatDateFields(model string, records []orm.Values) {
m := orm.Registry.Get(model)
diff --git a/pkg/server/webclient.go b/pkg/server/webclient.go
index 7c868ee..2e05d7d 100644
--- a/pkg/server/webclient.go
+++ b/pkg/server/webclient.go
@@ -2,6 +2,7 @@ package server
import (
"bufio"
+ "context"
"embed"
"encoding/json"
"fmt"
@@ -73,6 +74,14 @@ func (s *Server) handleWebClient(w http.ResponseWriter, r *http.Request) {
return
}
+ // Check if post-setup wizard is needed (first login, company not configured)
+ if s.isPostSetupNeeded() {
+ if sess := GetSession(r); sess != nil {
+ http.Redirect(w, r, "/web/setup/wizard", http.StatusFound)
+ return
+ }
+ }
+
// Check authentication
sess := GetSession(r)
if sess == nil {
@@ -141,7 +150,7 @@ func (s *Server) handleWebClient(w http.ResponseWriter, r *http.Request) {
%s