security: batch 2 — CR + programs chain (#264, #261, #338, #336, #353, #343, #365) - #422
Open
gonzalesedwin1123 wants to merge 7 commits into
Open
security: batch 2 — CR + programs chain (#264, #261, #338, #336, #353, #343, #365)#422gonzalesedwin1123 wants to merge 7 commits into
gonzalesedwin1123 wants to merge 7 commits into
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## 19.0 #422 +/- ##
==========================================
+ Coverage 72.24% 72.76% +0.51%
==========================================
Files 419 462 +43
Lines 29813 31545 +1732
==========================================
+ Hits 21539 22953 +1414
- Misses 8274 8592 +318
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands security batch 2 — the change-request + programs chain, seven interdependent fixes validated together on a staging branch so
19.0is never exposed to an unverified intermediate state.⚠ Merge with a MERGE COMMIT — not squash
Squashing collapses seven distinct security fixes into one opaque commit. The merge commit preserves one commit per fix (each carrying its
(#NNN)reference) for bisect and attribution. The repo default is squash — change it at merge time. (Batch 1 / #399 was accidentally squashed; do not repeat.)What's in it
Seven PRs, hard-ordered because the CR module version chain and a migration dir depend on it: #264 → #261 → #338 → #336 → #353 → #343 → #365.
spp_change_request_v2→ 3.1.2spp_change_request_v23.1.3,spp_cr_type_assign_program1.0.2spp_cr_type_assign_program→ 1.0.3spp_programs2.2.1,spp_program_geofence1.0.1,spp_farmer_registry_demo2.1.2spp_change_request_v23.1.4 (+migration),spp_programs2.2.2 (+migration)selected_fieldno longer bypasses CR conflict/duplicate checks (fail-closed)spp_change_request_v2→ 3.1.5spp_change_request_v2→ 3.1.6Review
Every fix was independently adversarially reviewed against its exact vulnerability, Odoo 19 core semantics, and test coverage before merging into staging (
internal/plans/batch2-fix-review.md): six ACCURATE-AND-COMPLETE with follow-ups only. The one CONCERNS finding — #338 rested on a false "module unreleased" premise, leaving a residual on already-deployed DBs — was fixed in-branch (apply-time sink re-check bound to the requester's company scope + preview redaction + corrected rationale) and that delta separately reviewed.Verification (on the merged staging tree)
19.0: CR 3.1.1→3.1.6, programs 2.2.0→2.2.2, assign_program 1.0.1→1.0.3, geofence 1.0.0→1.0.1, farmer_demo 2.1.1→2.1.2. Migration dirs match manifests (CR19.0.3.1.4, programs19.0.2.2.2).19.0is confined to exactly the 5 batch-2 modules, no riders (18 CR + 19 programs + 10 assign_program + 4 geofence + 5 farmer_demo files).--match-head-commit <CI'd head>(manifest:internal/plans/batch2-manifest.tsv), green on all module test jobs at that head. Each rebase was verified footprint-clean with its code files byte-identical to the reviewed head — only manifest/HISTORY/generated-README metadata was merged.workflow_dispatchon the staging head is running (linked in checks).check_version_chain.py: run post-merge it reports false "collision" errors, because the seven branches are now stacked (each rebased onto its predecessors) rather than independent off19.0— the tool's pre-merge model. The merged-tree checks above are the authoritative post-merge verification.🔴 Release notes — behavior changes
base.group_systemserver-side; program officers/managers/cycle-approvers can no longer clear an active operation lock via RPC.$applyendpoint now requires the endpoint user to holdgroup_cr_manager. Deployments applying CRs via API must grant that role.After merging
git show --remerge-diff <merge-sha>empty, andgit diff <merge-sha> origin/19.0-staging-sec-batch2empty.ir.rule(spp_farmer_registry_cr/spp_studio_change_requests), security(spp_change_request_v2): enforce manager authorization on CR apply (server-side) #365 API-level authz test + HTTP 403, security(roles): scope program/CR roles to Tier-3 registry read (drop registry-search menu) #353 load_menus assertion.Plan & manifest:
internal/plans/security-staging-merge-plan.md,internal/plans/batch2-manifest.tsv,internal/plans/batch2-fix-review.md.