Lewati ke isi

T5 — W16 Code Audit (STAB-033 / IA-010)

Mode: Server /home/scola/odoo
Date: 2026-08-29
Phase: W16-2 start
Baseline: FE 0d521e89 / BE 84b46c7 (pre-fix); DEC-W16 signed 2026-08-29

Scope

Audit duplicate canonical/legacy publication paths per STAB-033. Identify minimal safe fixes vs documented gaps for BLOCKED §5.3 rows.

Findings

Area Status Evidence
Canonical BE model + manage API Present scola.news + /api/manage/news* in scola_news/controllers/news_manage_api.py
Canonical FE create/publish route Present /admin/news/create (NewsWizard); menu communication.news.manage → /admin/news
Legacy FE write route Absent No /admin/announcement*; /announcement and /parent/announcement redirect → /news
Legacy portal HTTP API Read-only /api/portal/announcements GET only (portal_announcement_api.py)
Legacy Odoo model writes Fixed (W16-2) scola.announcement create/write/unlink blocked unless allow_legacy_announcement_mutation context; ACL write/create revoked for portal groups
Odoo backend legacy menus Gap portal_menu.xml still exposes Pengumuman CRUD menus for portal managers — read/history only after ACL; migration tooling needs context key
One-time migration Gap No legacy ID → canonical ID map or migration report (DEC-011 deferred)
Notification dedupe on migration Gap Not implemented — out of W16-2 minimal scope
Harness probe bug Fixed bool(empty recordset) falsely reported model missing; probe now uses 'scola.news' in env
VAL atomicity (RT-W16-VAL-01) Gap (FAIL) Harness W16-VAL-INVALID-PAYLOAD: API returns validation error but disposable row persisted — pre-insert guard deferred W16-3

Implemented (W16-2 minimal)

  1. BE legacy write guard — scola_portal/models/announcement.py: model-level block on create/write/unlink with escape hatch for future migration scripts.
  2. BE ACL tighten — scola_portal/security/ir.model.access.csv: portal user/manager announcement rows read-only.
  3. Harness probe fix — scripts/golden/w16_runtime_certify.py: correct surface detection; unblock CASE_CATALOG after DEC-W16 sign-off.

Documented gaps (not implemented this phase)

Matrix row Gap Next step
RT-W16-NEG-01 Harness handler W16-NEG-READONLY-DENIED not wired W16-3: capability-denied fixtures
RT-W16-STA-01 Harness handler W16-STA-TRANSITION-MATRIX not wired W16-3: invalid transition matrix
RT-W16-REC-01 No fault-injection handler W16-3: outbox failure probe
RT-W16-XRP-01 No propagation handler W16-3: target/non-target reader fixtures
RT-W16-XMD-01 Migration map absent; Odoo menu labels legacy W16-3 handler + optional menu hide/banner
RT-W16-UIA-01 FE static nav check not in BE harness W16-3: check:core-nav-ux + spot crawl evidence

FE canonical surface (no code change required)

  • communicationApp.js: single manage leaf /admin/news
  • AnnouncementList.vue: read-only list with CTA redirect to /admin/news/create for managers
  • Legacy deep links redirect per sharedExperienceRoutes.js and parentRouteFragments/core.js

References