fix(dci_compliance): stop requesting the rpc service Odoo 19 removed; show warnings to administrators only (#450) - #527
Open
gonzalesedwin1123 wants to merge 6 commits into
Open
gonzalesedwin1123 wants to merge 6 commits into
gonzalesedwin1123 wants to merge 6 commits into
Conversation
The `rpc` and `user` web services no longer exist, so `useService("rpc")`
throws "Service rpc is not available" at component setup() and the
component never mounts. The asset bundle still builds because the
useService import itself resolves, which is why two such calls survived
on 19.0 unnoticed (#450). Module CI runs without a browser, so nothing
else can catch this class before a user hits it.
Add a --js mode to scripts/lint/check_odoo19.py that flags both names in
frontend JavaScript and wire it as a third openspp-check-odoo19 hook,
excluding vendored static/lib, tour files, e2e and third-party modules.
Nothing in CI renders a frontend component: module tests run in an image without Chrome, and the two Playwright specs install the two starter packs only. That is how a systray item that threw at setup() and blanked the whole webclient (#450) shipped unnoticed. Add a third spec that installs spp_dci_compliance through Apps, asserts the webclient mounts with no client error dialog and that the item lists the three insecure settings the module's post-install hook turns on, then turns one off through System Parameters and asserts the badge drops to two. Wire it into the e2e matrix and the result summary.
The DCI security-warning systray item called useService("rpc") in its
setup(). Odoo 19 has no such service, so the call throws "Service rpc is
not available", and because the item is registered for every backend
user the whole webclient failed to mount: a blank page after login for
everyone on any database with spp_dci_compliance installed. Call rpc()
from @web/core/network/rpc directly, as the rest of the repo does.
CRReviewPanel in spp_change_request_v2 requested the same service and
never used the handle; drop the line. The panel is not mounted by any
view, so nothing was affected there (#524 decides its fate).
Add the first tests for the /dci/security/warnings route the item
depends on: response shape, tracking of the dci.* parameters, and a
JSON-RPC error for anonymous callers.
Bump spp_dci_compliance to 19.0.1.0.1 (first HISTORY fragment) and
spp_change_request_v2 to 19.0.3.1.17.
Fixes #450
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 19.0 #527 +/- ##
=======================================
Coverage 76.91% 76.91%
=======================================
Files 704 704
Lines 45774 45772 -2
=======================================
- Hits 35205 35204 -1
+ Misses 10569 10568 -1
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
…y; review fixes Applies the four-reviewer expert review of the first head. The systray item's one action opens the System Parameters list, which needs base.group_system, so every other user was told about settings they could neither see nor change and got an AccessError if they followed the call-to-action. The /dci/security/warnings route now answers with an empty summary outside base.group_system, the component skips the call for those users, and a plain-internal-user HttpCase pins it. The route is declared type="jsonrpc": type="json" is a deprecated alias on 19.0 that logged a warning on every module load, and this was the last one in the repo. Systray button: accessible label (its name was the bare badge count), text-bg-danger badge, translatable action title, =like domain instead of the substring-matching like, stale comment removed. Lint guard: match the whole file so a formatter-wrapped call is caught, strip comments so a migration note quoting the old call is not, cover env.services.rpc / env.services.user, template literals and extra arguments, and guard the useService prefix. HttpCase tagged post_install like every other HttpCase in the repo; anonymous test asserts the SessionExpiredException error name. E2E: record uncaught page errors and assert none (the failure mode of #450 is a blank page, not a dialog), locate the Value field by its field name, drop the unneeded debug flag, list spec 03 in the Discord summary.
gonzalesedwin1123
changed the title
This was referenced Sep 18, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #450.
What was broken
Odoo 19 has no
rpcweb service (addons/web/static/src/core/network/rpc_service.jsis gone on 19.0;core/network/rpc.jsexports a plainrpc()function instead).useService("rpc")therefore throwsService rpc is not availableinside a component'ssetup(). The asset bundle still builds, because theuseServiceimport itself resolves, so nothing surfaced until a component was actually mounted.Two components on 19.0 still requested it:
spp_dci_complianceDCISecurityWarningsystray itemisDisplayed: () => true)spp_change_request_v2CRReviewPanelThe module is described as test-only and no starter or demo stack installs it, which is why no CI stack and no demo ever hit this.
The fix
security_warning.js: importrpcfrom@web/core/network/rpcand call it directly, the same wayspp_farmer_registry,spp_cel_widgetandspp_gisalready do.useServicestays for theactionservice.base.group_system; every other user was told about settings they could neither see nor change, and got an AccessError if they followed the call-to-action. The route now returns an empty summary outsidebase.group_system(the real gate) and the component skips the call for those users (user.hasGroup, as inspp_pii_encryptionandspp_farmer_registry).type="jsonrpc":type="json"is a deprecated alias on 19.0 that logged aDeprecationWarningon every module load, and this was the last one in the repo.text-bg-dangerperui-design.md, the settings action title is translatable and its domain uses=like(likecompiled to a substring match).review_panel.js: drop the unusedthis.rpc = useService("rpc")line. Nothing else in the component changes (spp_change_request_v2: CRReviewPanel is never mounted — wire it in or remove it #524 decides whether it is wired in or removed).spp_dci_compliance19.0.1.0.0 → 19.0.1.0.1 (firstreadme/HISTORY.mdfor the module);spp_change_request_v219.0.3.1.16 → 19.0.3.1.17.Tests (written first, red before the fix, green after)
ci(lint)commits):scripts/lint/check_odoo19.py --jsflagsuseService("rpc")/useService("user")(any quote style, wrapped over lines, with extra arguments) andenv.services.rpc/env.services.userin frontend JavaScript, ignoring comments; wired asopenspp-check-odoo19-jsin pre-commit (vendoredstatic/lib, tour files,e2e/and third-party modules excluded). Red on exactly the two files at the base commit, clean on the rest of the repo, green after the fix. Documented in the internal principles doc (odoo19-compatibility.md→ "Removed Web Services", provisioned into checkouts, not tracked in this repo).spp_dci_compliance/tests/test_security_warning_controller.py(post_install): the/dci/security/warningsroute had no test. Four tests pin the response shape, that it tracks thedci.*parameters, that a plain internal user gets the empty summary even while a setting is on, and that an anonymous caller gets aSessionExpiredExceptionJSON-RPC error and never the payload.e2e/tests/03-spp-dci-compliance.spec.ts(+ matrix entry and Discord summary ine2e.yml, README row): installs the module through Apps, asserts the webclient mounts with no uncaught page error and no client error dialog and that the systray item lists the three settings the module's post-install hook enables, then turns one off in the System Parameters list and asserts the badge drops to 2. This is the only test in the repo that mounts the component. Before the fix it fails at test 02 with a blank page (.o_main_navbarnever appears). The e2e workflow runs on push to 19.0 only, so it was run locally (below).Review
Four-reviewer expert review (code, module verification, UX, adversarial) on the first head; all findings that touch files in this PR are applied in the
review fixescommit. Consolidated notes live in the internal workspace (pr527-expert-review.md). Follow-ups that are out of scope here: navbar icon contrast, hard-coded English warning texts in Python, badge going stale after a fix, keyboard navigation viaDropdownItem, hoisting the duplicated e2e helpers.Local evidence
Run locally on 2026-09-18 against the compose stack (
docker compose --profile ui):check_odoo19.py --json the two files, base commitcheck_odoo19.py --jsafter the fix;pre-commit run openspp-check-odoo19-js --all-files.o_main_navbarnever appears (blank page); console showsOwlError: An error occured in the owl lifecyclefromApp.handleError./spp t spp_dci_compliance, final head0 failed, 0 error(s) of 104 tests(100 existing + 4 new), verified on the result line; thetype='json'DeprecationWarning is gone from the log./spp t spp_change_request_v2(run by the verification reviewer)0 failed, 0 error(s) of 420 testspre-commit runon the changed filesoca-gen-addon-readmelocal rewrites reverted, CI's regeneration applied insteadBefore/after PNGs, the console capture and the Playwright logs are kept in the internal workspace under
internal/plans/issue-450-evidence/.Out of scope, noted
CRReviewPanelis dead code (643 lines shipped inweb.assets_backendfor nothing) and, per the review, also calls private methods remotely and reads fields that exist on no model.oca-gen-addon-readmeenv is the authority forREADME.rst; regenerated READMEs are applied from the CI diff.