Merge remote-tracking branch 'origin/19.0' into 19.0-staging-sec-batch1

Author: gonzalesedwin1123

docker/Dockerfile

@@ -77,6 +77,11 @@ RUN --mount=type=cache,target=/root/.cache/uv,sharing=locked \
     -r /tmp/openspp-requirements.txt
 
 # Download and install Odoo (cache the tarball to avoid re-downloading)
+# --no-deps: Odoo's runtime dependencies are already installed above from its
+# requirements.txt, which carries the correct per-Python-version pins. Odoo's
+# setup.py additionally declares an unpinned PyPDF2; resolving it installs
+# legacy PyPDF2 3.x, which odoo.tools.pdf then selects over pypdf and which
+# crashes multi-record PDF printing (OP#1168).
 RUN --mount=type=cache,target=/root/.cache/uv,sharing=locked \
     --mount=type=cache,target=/tmp/downloads,sharing=locked \
     set -eux; \
@@ -91,7 +96,7 @@ RUN --mount=type=cache,target=/root/.cache/uv,sharing=locked \
     mv /opt/odoo /opt/odoo-src; \
     mkdir -p /opt/odoo; \
     mv /opt/odoo-src /opt/odoo/odoo; \
-    uv pip install -e /opt/odoo/odoo
+    uv pip install --no-deps -e /opt/odoo/odoo
 
 # Download OCA dependencies in builder (cache tarballs to avoid re-downloading)
 RUN --mount=type=cache,target=/tmp/downloads,sharing=locked \

spp_base_common/README.rst

@@ -120,6 +120,17 @@ Dependencies
 Changelog
 =========
 
+19.0.2.0.2
+~~~~~~~~~~
+
+- test: add a regression test guarding the PDF backend selected by
+  ``odoo.tools.pdf``. The Docker image accidentally shipped legacy
+  PyPDF2 3.x next to pypdf; Odoo prefers PyPDF2 when importable, and its
+  removed 1.x API (``numPages``/``getPage``) crashes multi-record PDF
+  printing with a ``DeprecationError`` (OP#1168). The fix is in
+  ``docker/Dockerfile`` (``--no-deps`` on the Odoo editable install);
+  this test fails on any image that regresses.
+
 19.0.2.0.1
 ~~~~~~~~~~
 

spp_base_common/__manifest__.py

@@ -5,7 +5,7 @@
 {
     "name": "OpenSPP Base (Common)",
     "category": "OpenSPP/Core",
-    "version": "19.0.2.0.1",
+    "version": "19.0.2.0.2",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",

spp_base_common/readme/HISTORY.md

@@ -1,3 +1,7 @@
+### 19.0.2.0.2
+
+- test: add a regression test guarding the PDF backend selected by `odoo.tools.pdf`. The Docker image accidentally shipped legacy PyPDF2 3.x next to pypdf; Odoo prefers PyPDF2 when importable, and its removed 1.x API (`numPages`/`getPage`) crashes multi-record PDF printing with a `DeprecationError` (OP#1168). The fix is in `docker/Dockerfile` (`--no-deps` on the Odoo editable install); this test fails on any image that regresses.
+
 ### 19.0.2.0.1
 
 - fix(security): add `groups="base.group_system"` to the existing `<menuitem id="base.menu_management" />` override in `views/main_view.xml`. Out of the box the Apps top-level menu has no group restriction and is visible to every logged-in user, violating the OP#951 audit's `Apps: no` rows. The override here is the single authoritative declaration for this menu's attributes in the OpenSPP install (sequence, custom OpenSPP icon, and now group_ids); doing the gating anywhere upstream (e.g. a `post_init_hook` in `spp_security`) is unreliable because this `<menuitem>` reload re-writes the record without a `groups` attribute and resets `group_ids` to empty.

spp_base_common/static/description/index.html

@@ -495,6 +495,18 @@ <h2><a class="toc-backref" href="#toc-entry-1">Changelog</a></h2>
 </div>
 </div>
 <div class="section" id="section-1">
+<h1>19.0.2.0.2</h1>
+<ul class="simple">
+<li>test: add a regression test guarding the PDF backend selected by
+<tt class="docutils literal">odoo.tools.pdf</tt>. The Docker image accidentally shipped legacy
+PyPDF2 3.x next to pypdf; Odoo prefers PyPDF2 when importable, and its
+removed 1.x API (<tt class="docutils literal">numPages</tt>/<tt class="docutils literal">getPage</tt>) crashes multi-record PDF
+printing with a <tt class="docutils literal">DeprecationError</tt> (OP#1168). The fix is in
+<tt class="docutils literal">docker/Dockerfile</tt> (<tt class="docutils literal"><span class="pre">--no-deps</span></tt> on the Odoo editable install);
+this test fails on any image that regresses.</li>
+</ul>
+</div>
+<div class="section" id="section-2">
 <h1>19.0.2.0.1</h1>
 <ul class="simple">
 <li>fix(security): add <tt class="docutils literal"><span class="pre">groups=&quot;base.group_system&quot;</span></tt> to the existing
@@ -510,7 +522,7 @@ <h1>19.0.2.0.1</h1>
 <tt class="docutils literal">group_ids</tt> to empty.</li>
 </ul>
 </div>
-<div class="section" id="section-2">
+<div class="section" id="section-3">
 <h1>19.0.2.0.0</h1>
 <ul class="simple">
 <li>Initial migration to OpenSPP2</li>

spp_base_common/tests/__init__.py

@@ -1,2 +1,3 @@
 from . import test_ir_module_module
+from . import test_pdf_backend
 from . import test_phone_number_validation

spp_base_common/tests/test_pdf_backend.py

@@ -0,0 +1,40 @@
+import io
+
+from odoo.tests import TransactionCase
+from odoo.tools.pdf import PdfFileReader, PdfFileWriter
+
+
+class TestPdfBackend(TransactionCase):
+    """Guard the PDF backend selected by odoo.tools.pdf.
+
+    Printing a report for multiple records splits the combined document in
+    ir.actions.report._render_qweb_pdf_prepare_streams using the legacy
+    PyPDF2 1.x API (numPages, getPage, addPage). If the image ships legacy
+    PyPDF2 3.x, odoo.tools.pdf selects it over pypdf and that API raises
+    DeprecationError, so multi-record printing crashes while single-record
+    printing still works (OP#1168).
+    """
+
+    def _make_two_page_pdf(self):
+        from reportlab.pdfgen import canvas
+
+        buffer = io.BytesIO()
+        pdf_canvas = canvas.Canvas(buffer)
+        pdf_canvas.drawString(100, 750, "page 1")
+        pdf_canvas.showPage()
+        pdf_canvas.drawString(100, 750, "page 2")
+        pdf_canvas.showPage()
+        pdf_canvas.save()
+        buffer.seek(0)
+        return buffer
+
+    def test_01_multi_record_split_legacy_api(self):
+        # Mirrors the multi-record path of _render_qweb_pdf_prepare_streams
+        reader = PdfFileReader(self._make_two_page_pdf())
+        self.assertEqual(reader.numPages, 2)
+        for page_index in range(reader.numPages):
+            writer = PdfFileWriter()
+            writer.addPage(reader.getPage(page_index))
+            stream = io.BytesIO()
+            writer.write(stream)
+            self.assertTrue(stream.getvalue().startswith(b"%PDF"))

spp_drims/README.rst

@@ -179,6 +179,25 @@ Dependencies
 Changelog
 =========
 
+19.0.3.0.0
+~~~~~~~~~~
+
+- feat(drims): allocate stock per source warehouse. The Allocate Stock
+  wizard now auto-splits each requested line across the DRIMS warehouses
+  that hold stock (e.g. 70 → 50 @ WH1 + 20 @ WH2) with editable rows;
+  the split is captured on a new per-warehouse allocation record, shown
+  on the request's Allocations tab and summarised in a "Source
+  Warehouse(s)" column on the Requests list; dispatch creates one
+  picking per source warehouse. The single "Source Warehouse" field on
+  the request has been removed — the warehouse(s) are chosen in the
+  wizard. The allocation wizard distinguishes no-stock, stock-shortfall
+  and deliberate partial-allocation cases with clear messages, and the
+  request line's Fulfillment % tracks allocated ÷ requested so the bar
+  reflects allocation progress (#1079)
+- feat(drims): Requests review UI/UX overhaul — post-approval
+  fulfillment lanes, allocation shortfall indicators, and a
+  destination-type selector (#1075)
+
 19.0.2.0.0
 ~~~~~~~~~~
 

spp_drims/__manifest__.py

@@ -5,7 +5,7 @@
     "and distribution tracking. Links to hazard incidents with multi-tier "
     "approval workflows and warehouse operations.",
     "category": "OpenSPP/Inventory",
-    "version": "19.0.2.0.0",
+    "version": "19.0.3.0.0",
     "sequence": 1,
     "author": "OpenSPP.org",
     "website": "https://github.com/OpenSPP/OpenSPP2",
@@ -53,6 +53,7 @@
         # Wizards (before views, as views may reference wizard actions)
         "wizard/bulk_approve_wizard.xml",
         "wizard/request_reject_wizard_views.xml",
+        "wizard/request_revision_wizard_views.xml",
         "wizard/report_4w_wizard_views.xml",
         "wizard/stock_adjustment_wizard_views.xml",
         "wizard/inter_warehouse_transfer_wizard_views.xml",
@@ -88,6 +89,7 @@
             "spp_drims/static/src/js/qty_split_progress_field.js",
             "spp_drims/static/src/xml/qty_split_progress_field.xml",
             "spp_drims/static/src/css/inspection_wizard.css",
+            "spp_drims/static/src/css/request_form.css",
         ],
     },
     "application": True,

spp_drims/models/__init__.py

@@ -7,6 +7,7 @@
 from . import personnel
 from . import request
 from . import request_line
+from . import request_allocation
 from . import request_template
 from . import returns
 from . import stock_picking