@bergetai/odoo-cli 0.12.1 → 0.12.2

package/README.md

@@ -60,6 +60,17 @@ odoo documents records list --folder "Projects > Product Backlog"  # nested path
 odoo documents records show 25
 odoo documents records download 25 --out ./spec.pdf
 
+# Sales (sale.order) — quotations; sending stays a human step in the Odoo UI
+odoo sales orders list --state sent --partner "Softmizer" --json
+odoo sales orders read 11515                       # header + partner + order lines
+odoo sales orders create --partner 17682 --plan Monthly --lines lines.json --dry-run
+odoo sales orders update 11515 --set plan_id=2 --dry-run
+odoo sales lines add 11515 --lines extra.json
+odoo sales lines update 11818 --lines fix.json
+odoo sales plans list
+odoo sales invoices precedent --product 188        # invoicing currency history
+odoo sales pdf 11515 --out ./quotation.pdf
+
 # Mutations (support --dry-run)
 odoo crm leads create --name "New lead" --email info@example.com
 odoo crm leads update 42 --stage Won
@@ -144,6 +155,25 @@ Note: `odoo --version` prints the CLI's own version; `odoo version` queries the
 
 ## Features
 
+- Sales surface (`sales`) — quotations and sales orders (`sale.order`) without the raw XML-RPC plumbing: `orders list` (curated columns incl. pricelist/currency, `--partner`/`--state` filters plus `--filter`/`--domain`), `orders read` (full header, partner with VAT/address, and the order lines with sections/notes), `orders create` (first-class flags for `--partner`/`--pricelist`/`--payment-terms`/`--validity`/`--opportunity`/`--salesperson`/`--plan`/`--note`, order lines as a JSON array via `--lines <file>`/`-` supporting `line_section`/`line_note` lines and product lines with `tax_ids`; missing line name/price default from the product), `orders update` (header-only `--set` with an allowlist — setting `state` is refused by design: confirm/cancel is a human step in the Odoo UI), `lines add`/`lines update` (same JSON line format), `plans list` (`sale.subscription.plan`), `invoices precedent --product` (posted customer-invoice lines for a product, newest first — invoicing currency precedent), and `pdf <id> --out <path>` (portal quotation PDF via the order's `access_token`, verified `%PDF` magic). **Sending quotations is deliberately not implemented** — it is done by a human via 'Send by Email' in the Odoo UI (gives the customer Accept & Sign), CLI policy 2026-09-24
+- Signature pipeline (`sign`) — Odoo Sign with safety rails learned from live incidents:
+  - `sign templates list/show` and `sign templates create-from-document <id>` — builds a
+    `sign.template` from a Documents file, converting non-PDF files (`.docx` etc.) to PDF through
+    the self-hosted OnlyOffice Document Server (connection + JWT read from
+    `ir.config_parameter` `euro_office_connector.*`; temp attachment with `access_token`,
+    cleaned up after conversion)
+  - `sign items-add <template> --file items.json` — place signature/date/text fields from a JSON
+    spec (coordinates in % of page; type and role resolve by id, `item_type`, or name). Added via
+    the template's one2many because direct `sign.item.create` hits an ACL on this build
+  - `sign requests list` and `sign requests create <template>` — **no draft state exists**:
+    creating a request with partners in default state emails them in the same transaction
+    (verified incident 2026-09-23). Default is therefore a `shared` link (anonymous signer, no
+    email) with a printed sign URL; `--state sent --signer … --role … --subject …` requires an
+    explicit `--confirm-send` and goes through the `sign.send.request` wizard so the email
+    carries a subject AND the signing link (a bare state flip sends a body-less email). A UTC
+    `mail.mail` audit is printed after send; `sign requests cancel <id>` is the safety valve.
+    Shared links require single-role templates (the guard errors with guidance on multi-role
+    templates, since the server only accepts one anonymous signer per link)
 - Footprint overview (`footprint <email>`) — one read-only invocation that enumerates everything tied to an email across the erasure-relevant modules (`res.partner` incl. archived, `res.users`, `crm.lead`, `mailing.*`, `helpdesk.ticket`, `mail.message`, `ir.attachment`), correlates the found partners into the RESTRICT accounting surfaces (`account.move`/`sale.order` incl. invoice & shipping addresses, `account.payment`), and classifies every record by erasure disposition: `delete`, `anonymize` (referenced — shell, never unlink), `keep` (bokföringslagen 7-year retention), `review` (account roots, legal-claim branch, internal users, unverifiable attachment parents). `--json` emits a structured per-group payload (fixed 11-group key order, `totalRecords`, per-group `found`/`total` server count/`truncated`/`dispositions` tally, many2one tuples normalized to `{id, name}`) with a `commandHint` on each actionable record, a top-level `runOrder` (SOP execution order), and decision-grade fields on partner records (`child_ids`/`user_ids`/`vat`). Review records with out-of-footprint parents are resolved inline — the parent's name is embedded in the reason (bounded by a per-model fetch cap; beyond it records keep an `inspectHint`). Every record tells you what to run next — or already answers the question. Read-only by design: verification (art. 12.6) is a human step and the argument must already be the verified email; record-rule hidden rows (e.g. `user_notification` messages) mean the raw SQL pre-flight stays the authoritative evidence. Never mutates anything
 - Read-only CRM surface (`crm leads list/show`) — default columns, `--fields`/`--all-fields`, `--limit`/`--offset`/`--order`, `--domain`/`--filter` with `fields_get` type checking, reference resolution (`--stage`/`--team`/`--assignee`/`--tag`), table/JSON output with `search_count` envelope
 - Partners surface (`partners list/show/tags/create/update/delete`) — `res.partner` CRUD with `--company`/`--individual` filters, `--search` (case-insensitive name/email match), `--tag` (repeatable, resolves `res.partner.category` by exact name then ilike), `--archived` (include inactive), curated list columns (ID, Name, Company Type, City, Email, Is a Company, Tags, Salesperson), curated `show` view with tag names, salesperson, customer/supplier ranks plus every populated `x_studio*` custom field, `partners tags` (usage counts via `read_group`, sorted by usage), first-class mutation flags for `--name`, `--email`, `--phone`, `--website`, `--parent` (m2o), `--is-company`, `--street`, `--city`, `--zip`, `--country` (m2o), `--comment`, `--add-tag`/`--remove-tag` on update (unknown tags fail on add; removal silently skips tags the record lacks; protected fields `company_type` and `x_studio_invoice_approved` refuse writes), full `--dry-run` support, `--fields`/`--all-fields`, table/JSON output

package/dist/cli.js

@@ -12,6 +12,8 @@ import { versionCommand } from "./commands/version.js";
 import { partnersCreateCommand, partnersDeleteCommand, partnersListCommand, partnersShowCommand, partnersTagsCommand, partnersUpdateCommand, resPartner, } from "./commands/partners.js";
 import { usersDeleteCommand, usersShowCommand, } from "./commands/users.js";
 import { attachmentsDeleteCommand, attachmentsDownloadCommand, attachmentsListCommand, attachmentsShowCommand, } from "./commands/attachments.js";
+import { signTemplatesCreateFromDocumentCommand, signTemplatesListCommand, signTemplatesShowCommand, signItemsAddCommand, signRequestsCreateCommand, signRequestsListCommand, signRequestsCancelCommand, } from "./commands/sign.js";
+import { invoicesPrecedentCommand, linesAddCommand, linesUpdateCommand, ordersCreateCommand, ordersListCommand, ordersReadCommand, ordersUpdateCommand, pdfCommand, plansListCommand, } from "./commands/sales.js";
 import { messagesDeleteCommand, messagesListCommand, messagesScrubCommand, messagesShowCommand, } from "./commands/messages.js";
 import { contactsDeleteCommand, contactsListCommand, contactsShowCommand, listsListCommand, listsShowCommand, tracesDeleteCommand, tracesListCommand, tracesShowCommand, } from "./commands/marketing.js";
 import { modelsFieldsCommand, modelsReadCommand, } from "./commands/models.js";
@@ -821,6 +823,252 @@ Examples:
         .action(async (ids) => {
         await run((g) => attachmentsDeleteCommand(ids, g), program);
     });
+    const sign = program
+        .command("sign")
+        .description("Sign app (sign.template, sign.request) — safe signing pipeline");
+    const signTemplates = sign
+        .command("templates")
+        .description("signature templates");
+    signTemplates
+        .command("list")
+        .description("list signature templates")
+        .option("--archived", "include archived templates")
+        .option("--limit <n>", "max templates (default: 50)", "50")
+        .option("--json", "emit a single JSON object on stdout")
+        .action(async (opts) => {
+        await run((g) => signTemplatesListCommand(opts, g), program);
+    });
+    signTemplates
+        .command("show")
+        .description("read one signature template")
+        .argument("<id>", "sign.template id")
+        .option("--all-fields", "display every readable field")
+        .option("--json", "emit a single JSON object on stdout")
+        .action(async (id, opts) => {
+        await run((g) => signTemplatesShowCommand(id, opts, g), program);
+    });
+    signTemplates
+        .command("create-from-document")
+        .description("create a sign.template from a Documents file (converts non-PDF via the Document Server)")
+        .argument("<document>", "documents.document id")
+        .option("--name <name>", "template name (default: document name)")
+        .option("--json", "emit a single JSON object on stdout")
+        .action(async (doc, opts) => {
+        await run((g) => signTemplatesCreateFromDocumentCommand(doc, opts, g), program);
+    });
+    sign
+        .command("items-add")
+        .description("add signature fields from a JSON spec, via the template (direct sign.item writes are ACL-blocked)")
+        .argument("<template>", "sign.template id")
+        .requiredOption("--file <path>", "JSON items spec (coordinates in % of page)")
+        .option("--json", "emit a single JSON object on stdout")
+        .addHelpText("after", `
+Spec: [{"type":"signature","page":3,"x":12,"y":65,"width":24,"height":6,
+        "role":"Standard","name":"Signature","required":true}]
+"type" accepts a sign.item.type id, item_type (signature/date/text/...),
+or a name; "role" a sign.item.role id or name.
+
+Examples:
+  $ odoo sign items-add 12 --file items.json --dry-run
+  $ odoo sign items-add 12 --file items.json`)
+        .action(async (templateId, opts) => {
+        await run((g) => signItemsAddCommand(templateId, opts, g), program);
+    });
+    const signRequests = sign
+        .command("requests")
+        .description("signature requests");
+    signRequests
+        .command("list")
+        .description("list signature requests (newest first)")
+        .option("--state <state>", "filter by state (shared/sent/completed/canceled)")
+        .option("--limit <n>", "max requests (default: 30)", "30")
+        .option("--json", "emit a single JSON object on stdout")
+        .action(async (opts) => {
+        await run((g) => signRequestsListCommand(opts, g), program);
+    });
+    signRequests
+        .command("create")
+        .description("create a signature request. Default: shared draft link (anonymous, no email). --state sent emails the signers — requires --confirm-send")
+        .argument("<template>", "sign.template id")
+        .option("-s, --state <state>", "shared (default) or sent")
+        .option("--role <name|id>", "role for shared links (exactly one); repeatable for --state sent", collect, [])
+        .option("--signer <name|id>", "signer (partner email or id) for --state sent; one per --role", collect, [])
+        .option("--subject <subject>", "email subject (required with --state sent)")
+        .option("--message <text>", "email message body (optional)")
+        .option("--confirm-send", "required with --state sent — emails go out immediately")
+        .option("--json", "emit a single JSON object on stdout")
+        .addHelpText("after", `
+sign.request has NO draft state: creating a request with partners emails
+them in the same transaction. Shared links are the only safe pre-state.
+
+Examples:
+  $ odoo sign requests create 12 --role Customer --json
+  $ odoo sign requests create 12 --state sent --subject "Sign" \\
+      --signer markus@example.com --role Customer --confirm-send`)
+        .action(async (templateId, opts) => {
+        await run((g) => signRequestsCreateCommand(templateId, opts, g), program);
+    });
+    signRequests
+        .command("cancel")
+        .description("cancel a signature request (safety valve; preview with --dry-run)")
+        .argument("<id>", "sign.request id")
+        .option("--json", "emit a single JSON object on stdout")
+        .action(async (id, opts) => {
+        await run((g) => signRequestsCancelCommand(id, opts, g), program);
+    });
+    const sales = program
+        .command("sales")
+        .description("Sales app (sale.order, sale.order.line, sale.subscription.plan)")
+        .addHelpText("after", `
+Sending quotations is done by a human via 'Send by Email' in the Odoo UI
+(gives the customer Accept & Sign). Not available in this CLI by policy
+(2026-09-24).`);
+    const salesOrders = sales
+        .command("orders")
+        .description("quotations and sales orders (sale.order)");
+    salesOrders
+        .command("list")
+        .description("search and list orders with curated default columns")
+        .option("--partner <name|id>", "filter by customer (resolved by name)")
+        .option("--state <state>", "filter by state: draft, sent, sale, cancel")
+        .option("--filter <f=v>", "equality filter; repeatable, AND-ed", collect, [])
+        .option("--domain <json>", "Odoo domain as a JSON array (mutually exclusive with --filter)")
+        .option("--fields <a,b,c>", "columns to display")
+        .option("--limit <n>", "max records (default: 50)", "50")
+        .option("--offset <n>", "skip the first n records", "0")
+        .option("--order <order>", 'sort order, e.g. "amount_total desc"', undefined)
+        .action(async (opts) => {
+        await run((g) => ordersListCommand(opts, g), program);
+    });
+    salesOrders
+        .command("read")
+        .description("read one order in full, including order lines and partner details")
+        .argument("<id>", "order id")
+        .action(async (id) => {
+        await run((g) => ordersReadCommand(id, g), program);
+    });
+    salesOrders
+        .command("create")
+        .description("create a quotation (preview with --dry-run)")
+        .requiredOption("--partner <id|name>", "customer (res.partner id, or name)")
+        .option("--pricelist <id|name>", "pricelist (product.pricelist)")
+        .option("--payment-terms <id|name>", "payment terms (account.payment.term)")
+        .option("--validity <yyyy-mm-dd>", "quotation validity date")
+        .option("--opportunity <id|name>", "linked opportunity (crm.lead)")
+        .option("--salesperson <id|email|name>", "salesperson (res.users)")
+        .option("--plan <id|name>", "subscription plan (sale.subscription.plan)")
+        .option("--note <html>", "terms & conditions note (HTML allowed)")
+        .option("--lines <file>", "order lines as a JSON array from a file ('-' for stdin)")
+        .addHelpText("after", `
+Line JSON format: an array of objects —
+  {"display_type":"line_section","name":"Section title"}
+  {"display_type":"line_note","name":"Note text"}
+  {"product_id":188,"product_uom_qty":1,"price_unit":150,"tax_ids":[37]}
+On product lines, name defaults to the product name and price_unit to the
+product list price; product_uom_qty defaults to 1.
+
+Examples:
+  $ odoo sales orders create --partner 17682 --lines lines.json --dry-run
+  $ odoo sales orders create --partner "Acme AB" --pricelist "SEK price list" \\
+      --payment-terms "30 Days" --validity 2026-10-24 --plan Monthly --lines -`)
+        .action(async (opts) => {
+        await run((g) => ordersCreateCommand(opts, g), program);
+    });
+    salesOrders
+        .command("update")
+        .description("update order header fields (preview with --dry-run; state is NOT settable)")
+        .argument("<id>", "order id")
+        .option("--set <f=v>", "set a header field (plan_id, pricelist_id, payment_term_id, validity_date, note, opportunity_id, user_id); repeatable", collect, [])
+        .addHelpText("after", `
+State changes (confirm/cancel) are deliberately NOT possible here — they
+happen in the Odoo UI by a human. Sending quotations is likewise a human
+step ('Send by Email' in the UI). Order lines are managed via 'sales lines'.
+
+Examples:
+  $ odoo sales orders update 11515 --set plan_id=1 --dry-run
+  $ odoo sales orders update 11515 --set validity_date=2026-10-24 --set note="<p>Updated</p>"`)
+        .action(async (id, opts) => {
+        await run((g) => ordersUpdateCommand(id, opts, g), program);
+    });
+    const salesLines = sales
+        .command("lines")
+        .description("order lines (sale.order.line)");
+    salesLines
+        .command("add")
+        .description("add order lines to an order (preview with --dry-run)")
+        .argument("<order-id>", "sale.order id")
+        .requiredOption("--lines <file>", "order lines as a JSON array from a file ('-' for stdin)")
+        .addHelpText("after", `
+Same line JSON format as 'sales orders create'.
+
+Examples:
+  $ odoo sales lines add 11515 --lines extra-lines.json --dry-run
+  $ echo '[{"product_id":188,"product_uom_qty":1,"price_unit":150,"tax_ids":[37]}]' | odoo sales lines add 11515 --lines -`)
+        .action(async (orderId, opts) => {
+        await run((g) => linesAddCommand(orderId, opts, g), program);
+    });
+    salesLines
+        .command("update")
+        .description("update one order line (preview with --dry-run)")
+        .argument("<line-id>", "sale.order.line id")
+        .requiredOption("--lines <file>", "single line object as JSON from a file ('-' for stdin)")
+        .addHelpText("after", `
+The JSON must contain exactly one line object; only the keys present are
+updated (display_type, name, product_id, product_uom_qty, price_unit,
+tax_ids).
+
+Examples:
+  $ odoo sales lines update 20123 --lines line-fix.json --dry-run
+  $ echo '[{"price_unit":175}]' | odoo sales lines update 20123 --lines -`)
+        .action(async (lineId, opts) => {
+        await run((g) => linesUpdateCommand(lineId, opts, g), program);
+    });
+    const salesPlans = sales
+        .command("plans")
+        .description("subscription plans (sale.subscription.plan)");
+    salesPlans
+        .command("list")
+        .description("list subscription plans")
+        .option("--limit <n>", "max records (default: 50)", "50")
+        .action(async (opts) => {
+        await run((g) => plansListCommand(opts, g), program);
+    });
+    const salesInvoices = sales
+        .command("invoices")
+        .description("invoicing reports (account.move.line)");
+    salesInvoices
+        .command("precedent")
+        .description("posted customer-invoice lines for a product (newest first) — invoicing currency precedent")
+        .requiredOption("--product <id|name>", "product (product.product)")
+        .option("--limit <n>", "max records (default: 20)", "20")
+        .addHelpText("after", `
+Searches account.move.line where the product matches and the parent move is
+a posted customer invoice (move_type=out_invoice, state=posted). Use it to
+determine the invoicing currency precedent for a product before quoting.
+
+Examples:
+  $ odoo sales invoices precedent --product 188
+  $ odoo sales invoices precedent --product 188 --limit 5 --json`)
+        .action(async (opts) => {
+        await run((g) => invoicesPrecedentCommand(opts, g), program);
+    });
+    sales
+        .command("pdf")
+        .description("download the portal quotation PDF for an order")
+        .argument("<id>", "order id")
+        .requiredOption("--out <path>", "output path for the PDF")
+        .option("--force", "overwrite an existing output file")
+        .addHelpText("after", `
+Reads the order's access_token (falling back to get_portal_url) and
+downloads {base_url}/my/orders/<id>?access_token=<token>&report_type=pdf.
+The downloaded file is verified to start with %PDF.
+
+Examples:
+  $ odoo sales pdf 11515 --out ./quotation.pdf
+  $ odoo sales pdf 11515 --out ./quotation.pdf --dry-run`)
+        .action(async (id, opts) => {
+        await run((g) => pdfCommand(id, opts, g), program);
+    });
     const messages = program
         .command("messages")
         .description("chatter messages (mail.message), erasure-scoped");