H. Open questions and confirmed inconsistencies¶
Snapshot reconnaissance statis untuk perancangan dokumentasi pengguna berbasis role dan contextual help.
Last verified: 2026-08-05
Mode: server development
Workspace root: /home/scola/odoo
Scope: items requiring product owner, security, DPO, operations, or school SME confirmation
Runtime limitation: Missing or unclear — audit ini tidak memeriksa database tenant, modul yang terpasang, group efektif per user, atau perilaku bundle production
Status bukti yang dipakai secara eksklusif: Confirmed from code, Inferred from code, Requires business confirmation, dan Missing or unclear.
H1. Confirmed implementation mismatches and risks¶
These rows describe current static code behavior. They are not assumptions about intended policy and should be triaged before writing instructions that teach users to rely on the behavior.
| ID | Area | Code finding | Why it matters | Evidence | Question/decision | Confidence |
|---|---|---|---|---|---|---|
| SEC-01 | Public complaint | Internal complaint/config endpoints use auth=user, sudo, and are absent from the capability registry; any authenticated user can reach read/write paths according to static guards. | Unauthorized complaint/config exposure or mutation | ../custom_addons_scola/gcgscola/scola_public_complaint/controllers/public_complaint_api.py:1; ../custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:1 |
Who must read, assign, respond, export, and configure complaints? | Confirmed from code |
| SEC-02 | Weekly report approval | Global and local guards accept broad academics capability; student/alumni patterns can reach list/approve/reject paths using sudo. | Students could approve/reject company weekly reports | ../custom_addons_scola/gcgscola/scola_lms/controllers/lms_weekly_approval_api.py:1; src/config/roleCapabilities.js:1 |
Restrict approval to which roles and assignments? | Confirmed from code |
| DEF-01 | Promotion | Controller calls undefined helper _can_view_report_cards for non-admin paths. | Promotion workflow returns server_error for intended workflow roles | ../custom_addons_scola/gcgscola/scola_report_card/controllers/promotion_admin_api.py:21 |
Fix required before documenting operational steps; which roles own recommend/decide/execute? | Confirmed from code |
| SEC-03 | Counseling | Staff endpoints equate view/manage and use sudo; broad role capabilities can expose or mutate company-wide sensitive cases while portal endpoints are scoped. | Sensitive counseling privacy and unauthorized mutation | ../custom_addons_scola/gcgscola/scola_counseling/controllers/counseling_domain_api.py:1; ../custom_addons_scola/gcgscola/scola_counseling/controllers/counseling_portal_api.py:1 |
Define case visibility by counselor assignment, homeroom, student, parent, and school leadership. | Confirmed from code |
| SEC-04 | Payroll | Admin payroll/config endpoints are globally gated by hr.payslip.view and sudo; broad employee roles can read company payslips, salary lines, contract wage, tax, and net. | Payroll confidentiality breach | ../custom_addons_scola/gcgscola/scola_payroll/controllers/payroll_api.py:1; ../custom_addons_scola/gcgscola/scola_payroll/controllers/payslip_admin_api.py:1 |
Separate self-payslip, payroll operator, reviewer, approver, and auditor capabilities. | Confirmed from code |
| SEC-05 | Kesiswaan | Achievement, permit, and incident endpoints use broad students.list.view routes plus sudo; approval can update points/attendance and notify parents. | Company-wide mutation beyond intended student-affairs scope | ../custom_addons_scola/gcgscola/scola_student_activity/controllers/kesiswaan_domain_api.py:1; ../custom_addons_scola/gcgscola/scola_student_activity/controllers/violation_admin_api.py:1 |
Which actors may create, review, approve, reject, and view each record type? | Confirmed from code |
| SEC-06 | Accounting | A broad journal.view prefix and local helpers accepting view capabilities protect many sudo-backed accounting mutations; several direct browse/search paths lack company checks. | Unauthorized financial mutation or cross-company access | ../custom_addons_scola/gcgscola/scola_account/controllers/accounting_modules_api.py:1; ../custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:1 |
Define least-privilege view/create/edit/post/reconcile/approve capabilities and tenant scope. | Confirmed from code |
| RULE-01 | BOS/RKAS procurement | Budget view is treated as manage in paths; repeated purchase-request approval can add commitment twice; attachment model/res_id is client controlled without explicit MIME/size policy. | Double commitment and attachment abuse | ../custom_addons_scola/gcgscola/scola_bos_rkas_procurement/controllers/procurement_admin_api.py:1; ../custom_addons_scola/gcgscola/scola_bos_rkas/controllers/budget_admin_api.py:1 |
Should approvals be idempotent, and what attachment policy/approval chain applies? | Confirmed from code |
| SEC-07 | Dapodik | Connector configuration and destructive sync share settings.dapodik.view; several NISN/NUPTK/name lookups are not company-scoped. | Cross-tenant matching and destructive sync under a view capability | ../custom_addons_scola/gcgscola/scola_dapodik_connector/controllers/dapodik_api.py:1; ../custom_addons_scola/gcgscola/scola_dapodik_connector/controllers/kesiswaan_dapodik_api.py:1 |
Separate configure/preview/sync/destructive actions and define cross-company matching policy. | Confirmed from code |
| RULE-02 | Attendance | Daily attendance transitions and notifications are implemented, but cancel notify_parent input is ignored; HR attendance period lock is informational and legacy summaries have incomplete tenant scope. | Documentation could promise a lock/notification behavior not enforced | ../custom_addons_scola/gcgscola/scola_attendance/models/op_attendance_sheet.py:1; ../custom_addons_scola/gcgscola/scola_hr_attendance/controllers/hr_attendance_admin_api.py:1 |
What does lock mean, and should cancel always notify parents? | Confirmed from code |
| RULE-03 | RFID | Device/card CRUD is protected by read-named capability; failed event is marked processed, so queued response does not lead to automatic retry. | Role mismatch and lost automatic retry | ../custom_addons_scola/gcgscola/scola_smart_attendance/controllers/rfid_events_api.py:1; ../custom_addons_scola/gcgscola/scola_smart_attendance/models/rfid_event.py:1 |
Who manages devices/cards, and what retry/dead-letter behavior is required? | Confirmed from code |
| RULE-04 | Library | Queue assignment lacks a final concurrency re-check; lost/damaged return paths may leave a copy issued; fines can auto-post. | Double reservation or inconsistent copy/fine state | ../custom_addons_scola/gcgscola/scola_library/controllers/library_queue_return_api.py:1 |
Confirm queue ordering, concurrency, copy status transitions, and fine posting/waiver rules. | Inferred from code |
| SEC-08 | Mail tracking | Core reference endpoint accepts arbitrary model/res_id, sudo-reads mail.tracking.value, and is gated only by users.profile.view. | Cross-record/cross-tenant change-history disclosure | ../custom_addons_scola/gcgscola/scola_core/controllers/core_reference_api.py:42 |
Which models may expose history, and how must record/company access be enforced? | Confirmed from code |
| SEC-09 | Admission and fees | Admission config save/delete uses view checks; fee enrollment detail/schedules/lookups have weaker company scope than lists; payment setup view roles can mutate bank/gateway config. | Configuration mutation or cross-tenant finance/student exposure | ../custom_addons_scola/gcgscola/scola_admission/controllers/admission_config_api.py:1; ../custom_addons_scola/gcgscola/scola_fees/controllers/fee_enrollment_api.py:1 |
Define configure/manage permissions and tenant scope for SPMB, fee enrollment, and payment setup. | Confirmed from code |
| RBAC-01 | Prefix registry | First-prefix matching shadows three more-specific capability rules, including library purchase update, finance generate-preview, and LMS modul-ajar. | Unexpected weaker or stronger authorization than declared | ../custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:1 |
Should resolution use longest-prefix or ordered explicit exceptions? | Confirmed from code |
| RBAC-02 | Frontend student create/import | Routes /students/create and /students/import require students.list.view while list buttons use students.manage and target pages can call mutation endpoints. | View-only user may directly navigate to mutation UI | src/router/studentDataAdminRoutes.js:1; src/views/AdminViews/StudentDatabase/StudentList.vue:1 |
Should create/import routes require students.manage? | Confirmed from code |
| RBAC-03 | Frontend settings/library | Company settings writes and StudyGroup mutations use view-named access contracts; Library Settings route uses view while API registry uses manage and save lacks an equivalent page guard. | UI/API permission drift | src/router/libraryManagementRoutes.js:1; src/views/LibraryManagement/Settings/LibrarySettings.vue:1; src/access/apiRouteAccessRegistry.js:1 |
Normalize view/manage semantics per action. | Confirmed from code |
| NAV-01 | Menu-route drift | Modeled all-flags-on run finds 79 visible menu leaves denied by route guard, concentrated in lab technician, infrastructure VP, head admin, VP roles, foundation HR, principal, and alumni. | Dead menu links | src/config/apps/roleApps.js:1; src/router/routerGuardPolicy.js:1 |
Are menu assignments wrong, route allowedRoles too narrow, or both? | Inferred from code |
| NAV-02 | Analytics app | Role-visible analytics leaves redirect into destinations whose route guards reject admin/principal/foundation chairman in the modeled checks; contract tests only assert redirects exist. | Dead analytics navigation | src/config/apps/index.js:1; src/router/appRouteCatalog.js:1 |
What are the canonical analytics destinations and roles? | Confirmed from code |
| NAV-03 | Role/app registries | Frontend ROLE_APPS has 33 roles while its ROLES catalog omits foundation, security_officer, school_committee, and bos_admin; cashier is orphaned; backend canonical catalog has 32 roles and no generic foundation role; eight configured home paths are absent. | Role switcher/home navigation inconsistencies | src/config/apps/roleApps.js:1; src/config/roleCapabilities.js:1; ../custom_addons_scola/gcgscola/scola_core/services/role_catalog.py:1 |
Which roles and home routes are canonical? | Confirmed from code |
| FLAG-01 | Feature/module gates | Synthetic/unknown module keys are ignored by the feature normalizer; secondaryFeatureFlag is not enforced; no effective route uses scola_admission as the primary flag. | Menus/routes may remain visible under unexpected module combinations | src/config/featureFlagFragments/platformFeatureFlags.js:1; src/router/routerGuardPolicy.js:1 |
Define a single canonical primary/secondary module-gate contract. | Confirmed from code |
| COMM-01 | News vs announcement | Canonical scola.news and legacy scola.announcement coexist with different audience, approval, menus, and APIs. | Editors/readers cannot know which publication system is authoritative | ../custom_addons_scola/gcgscola/scola_news/models/scola_news.py:102; ../custom_addons_scola/gcgscola/scola_portal/models/announcement.py:15 |
Which system is canonical, and what migration/deprecation path applies? | Confirmed from code |
| SEC-10 | Legacy announcement | List/detail use sudo with incomplete company/audience/expiry enforcement; known IDs can expose published targeted announcements. | Cross-company or wrong-audience content disclosure | ../custom_addons_scola/gcgscola/scola_portal/controllers/portal_api.py:205 |
Must legacy announcements be tenant and audience scoped or removed? | Confirmed from code |
| SEC-11 | Messaging | Last-message batch sudo-reads arbitrary channel IDs; internal user search is cross-company; group creation accepts arbitrary partners; generic attachment creation accepts arbitrary model/res_id. | Cross-channel/cross-tenant privacy and attachment abuse | ../custom_addons_scola/gcgscola/scola_portal/controllers/general_messaging_api.py:794; ../custom_addons_scola/gcgscola/scola_portal/controllers/general_messaging_api.py:945 |
Define membership, company, contact discovery, and attachment restrictions. | Confirmed from code |
| SEC-12 | Notifications and calendar | Internal notification ACL/menu exposes broad logs; quiet-hours/config scope is inconsistent; calendar admin uses sudo without company/owner checks and teacher public events can cross companies. | Recipient/message/calendar privacy and ineffective preferences | ../custom_addons_scola/gcgscola/scola_portal/controllers/calendar_admin_api.py:44; ../custom_addons_scola/gcgscola/scola_portal/models/portal_notification.py:137 |
Define tenant scope, admin roles, quiet-hours semantics, and calendar audience. | Confirmed from code |
H2. Placeholder or stub pages¶
| Module | Page | Route | Component | Documentation decision |
|---|---|---|---|---|
| lab-technician | Alat & Bahan | /lab-technician/inventory |
src/views/Laboran/Inventory/LabInventoryList.vue:1 |
Missing or unclear — route exists but page content is placeholder/stub; do not author procedural guide yet |
| lab-technician | Peminjaman | /lab-technician/loans |
src/views/Laboran/Loans/LoanList.vue:1 |
Missing or unclear — route exists but page content is placeholder/stub; do not author procedural guide yet |
| lab-technician | Kerusakan | /lab-technician/maintenance/damage |
src/views/Laboran/Maintenance/DamageReports.vue:1 |
Missing or unclear — route exists but page content is placeholder/stub; do not author procedural guide yet |
| lab-technician | Perawatan Rutin | /lab-technician/maintenance/routine |
src/views/Laboran/Maintenance/RoutineMaintenance.vue:1 |
Missing or unclear — route exists but page content is placeholder/stub; do not author procedural guide yet |
| lab-technician | Laporan | /lab-technician/reports |
src/views/Laboran/Reports/LabReports.vue:1 |
Missing or unclear — route exists but page content is placeholder/stub; do not author procedural guide yet |
| lab-technician | Jadwal Penggunaan | /lab-technician/schedule |
src/views/Laboran/Schedule/LabSchedule.vue:1 |
Missing or unclear — route exists but page content is placeholder/stub; do not author procedural guide yet |
| Register.vue | Register | /register |
src/views/Register.vue:1 |
Missing or unclear — route exists but page content is placeholder/stub; do not author procedural guide yet |
H3. Questions for product owner and school subject-matter experts¶
| ID | Area | Question/decision | Owner | Why required | Status |
|---|---|---|---|---|---|
| P01 | Canonical roles | Approve one role glossary and mapping across ROLE_APPS, ROLES, frontend capability fallback, backend canonical roles/groups, and school terminology. | Product owner + security | Role-based documentation and screenshots cannot be stable without it. | Requires business confirmation |
| P02 | Active role semantics | Should switching active role also reduce effective backend permissions, or only change the UI context? | Product owner + security | Current backend authorization can use union of assigned groups/capabilities. | Requires business confirmation |
| P03 | Tenant/company scope | For every cross-school capable role, which records may be read or mutated across companies/foundations? | Product owner + DPO | Many sudo paths need an explicit scope contract. | Requires business confirmation |
| P04 | View versus manage | Adopt an action taxonomy for view/create/edit/delete/import/sync/approve/post/publish/configure/export. | Product owner + security | 305 backend mutation-shaped route instances first-match a .view capability; local guards vary. | Requires business confirmation |
| P05 | Approval ownership | Name the submitter/reviewer/approver/finalizer and delegation rules for SPMB, attendance, weekly reports, report cards, promotion, payroll, accounting, BOS, counseling, and news. | School SME | Code contains transitions but intended human responsibility is not consistently encoded. | Requires business confirmation |
| P06 | State glossary | Approve user-facing meanings and reversibility for draft/submitted/approved/published/posted/finalized/closed/cancelled/rejected/executed. | School SME | Same terms have domain-specific consequences. | Requires business confirmation |
| P07 | Master-data ownership | Who owns academic year, term, jenjang, rombel, course, classroom, employee, contract, fee, COA, inventory, and library policy, and when can each be changed? | School SME | These are prerequisites and downstream dependencies across workflows. | Requires business confirmation |
| P08 | Notification contract | Which transitions must notify student/parent/staff, through which channel, with what retry and quiet-hour policy? | Product owner + school SME | Several flows notify, skip, ignore parameters, or lack retries differently. | Requires business confirmation |
| P09 | Sensitive-data help | Which pages require privacy warnings, masked fields, audit explanation, retention, and no-screenshot guidance? | DPO + product owner | Payroll, counseling, complaints, messaging, attendance biometrics, and student records are sensitive. | Requires business confirmation |
| P10 | Error/recovery paths | Define recovery for failed import/sync/payment/posting/exam submit/RFID/notification and whether operations are idempotent. | Product owner + operations | Happy-path code exists more consistently than user-visible recovery contracts. | Requires business confirmation |
| P11 | Jenjang/date scoping | Which pages must use active academic year, selected date, current batch, and PAUD/non-PAUD mode? | Curriculum/attendance SME | Menus and data queries sometimes have separate jenjang/date logic. | Requires business confirmation |
| P12 | Legacy deprecation | Approve treatment of aliases, duplicate publication systems, legacy attendance summaries, old VP dashboard homes, and placeholder Laboran pages. | Product owner | Documentation should not normalize obsolete or unfinished entry points. | Requires business confirmation |
| P13 | Runtime baseline | Which database/tenant/module bundle and seeded role accounts should be used for the documentation acceptance pass? | Product owner + operations | Static inventory cannot confirm installed modules or effective tenant data. | Requires business confirmation |
| P14 | Contextual help delivery | Choose help format: inline field hints, action confirmation copy, state glossary drawers, role-specific walkthroughs, and deep links to user guide. | Product owner + UX | Priority list identifies surfaces but not the desired content mechanism. | Requires business confirmation |
H4. Runtime verification still missing¶
- Missing or unclear — which of the 67 addons are installed and active in each target database.
- Missing or unclear — effective role/group/capability payload for representative users in each tenant and multi-role combination.
- Missing or unclear — feature flags/module availability and jenjang configuration actually returned by production sessions.
- Missing or unclear — real data prerequisites, empty states, error payloads, state transitions, notifications, generated records, and cross-page refresh behavior.
- Missing or unclear — served-bundle parity with this source snapshot; no build/deploy/runtime browser check was authorized in this reconnaissance stage.