@bergetai/odoo-cli 0.9.2 → 0.11.0

package/dist/commands/marketing.js

@@ -0,0 +1,184 @@
+import { ModelFields, resolveReference } from "../model.js";
+import { authenticatedClient, showCommand, } from "../resource.js";
+import { deleteCommand } from "../mutation.js";
+import { usageError } from "../errors.js";
+import { colorEnabled, printJson } from "../output.js";
+import { formatTable, humanCell } from "../table.js";
+import { parseDomain } from "../filter.js";
+/**
+ * Marketing surface (mailing.list / mailing.contact / mailing.trace).
+ *
+ * Read-only lists; contacts and traces support explicit, id-based deletion —
+ * mail data is personal data for erasure (invariant 4): `mailing.trace`
+ * carries a denormalized `email` with NO FK to `mailing.contact`, so deleting
+ * contacts never removes traces; both deletions are explicit CLI steps.
+ *
+ * Email is the only reliable key (name matching showed casing variance in
+ * prod): `contacts list --email` matches the email column alone; `--search`
+ * keeps the repo-wide name-or-email ilike for interactive browsing.
+ */
+export const mailingList = {
+    model: "mailing.list",
+    showCommand: "odoo marketing lists show",
+    defaultListFields: ["id", "name", "contact_count", "active", "create_date"],
+    showExtraFields: [
+        "is_public",
+        "mailing_count",
+        "subscription_ids",
+        "write_date",
+    ],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+export const mailingContact = {
+    model: "mailing.contact",
+    showCommand: "odoo marketing contacts show",
+    defaultListFields: ["id", "email", "name", "is_blacklisted", "create_date"],
+    showExtraFields: [
+        "list_ids",
+        "subscription_ids",
+        "email_normalized",
+        "company_name",
+        "tag_ids",
+        "write_date",
+    ],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+export const mailingTrace = {
+    model: "mailing.trace",
+    showCommand: "odoo marketing traces show",
+    defaultListFields: [
+        "id",
+        "email",
+        "model",
+        "res_id",
+        "trace_status",
+        "mass_mailing_id",
+        "create_date",
+    ],
+    showExtraFields: [
+        "trace_type",
+        "sent_datetime",
+        "open_datetime",
+        "reply_datetime",
+        "failure_type",
+        "write_date",
+    ],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+function parseCount(raw, flag) {
+    if (!/^\d+$/.test(raw)) {
+        throw usageError(`invalid ${flag} value ${JSON.stringify(raw)}`, "expected a non-negative integer");
+    }
+    return Number(raw);
+}
+/** Shared list machinery for the three read-only/list surfaces. */
+async function runList(config, opts, domain, globals) {
+    const client = await authenticatedClient(globals);
+    const fieldsMeta = await ModelFields.load(client, config.model);
+    const limit = parseCount(opts.limit, "--limit");
+    const offset = parseCount(opts.offset, "--offset");
+    const fields = opts.fields
+        ? opts.fields
+            .split(",")
+            .map((f) => f.trim())
+            .filter((f) => f !== "")
+        : config.defaultListFields;
+    for (const field of fields) {
+        if (field !== "id" && !fieldsMeta.get(field)) {
+            throw usageError(`unknown field ${JSON.stringify(field)} on ${config.model}`, `run \`odoo models fields ${config.model}\` to check availability`);
+        }
+    }
+    const order = opts.order ?? "id asc";
+    const [records, count] = await Promise.all([
+        client.executeKw(config.model, "search_read", [domain], {
+            fields,
+            limit,
+            offset,
+            order,
+        }),
+        client.executeKw(config.model, "search_count", [domain]),
+    ]);
+    if (globals.json) {
+        printJson({ model: config.model, records, count, limit, offset });
+        return;
+    }
+    const headers = fields.map((f) => fieldsMeta.get(f)?.string ?? f);
+    const rows = records.map((rec) => fields.map((f) => humanCell(rec[f])));
+    process.stdout.write(formatTable(headers, rows, colorEnabled(globals.noColor)) + "\n");
+}
+export async function listsListCommand(opts, globals) {
+    const domain = [];
+    if (opts.search)
+        domain.push(["name", "ilike", opts.search]);
+    if (opts.domain)
+        domain.push(...parseDomain(opts.domain));
+    return runList(mailingList, opts, domain, globals);
+}
+export function listsShowCommand(idArg, opts, globals) {
+    return showCommand(mailingList, idArg, opts, globals);
+}
+/**
+ * `--list` resolves a mailing list by name (exact first, then ilike via the
+ * shared reference resolution) and filters contacts through the `list_ids`
+ * m2m (flat "contains" domain — verified against prod fields_get).
+ */
+export async function contactsListCommand(opts, globals) {
+    const client = await authenticatedClient(globals);
+    await ModelFields.load(client, "mailing.contact"); // module-installed check
+    const domain = [];
+    if (opts.list) {
+        const list = await resolveReference(client, "mailing.list", opts.list, {
+            label: "mailing list",
+        });
+        domain.push(["list_ids", "=", list.id]);
+    }
+    if (opts.email && opts.search) {
+        throw usageError("--email and --search are mutually exclusive", "--email is the identity-safe filter (email column only); --search matches name OR email");
+    }
+    if (opts.email) {
+        domain.push(["email", "ilike", opts.email]);
+    }
+    else if (opts.search) {
+        domain.push("|", ["name", "ilike", opts.search], ["email", "ilike", opts.search]);
+    }
+    if (opts.domain)
+        domain.push(...parseDomain(opts.domain));
+    return runList(mailingContact, opts, domain, globals);
+}
+export function contactsShowCommand(idArg, opts, globals) {
+    return showCommand(mailingContact, idArg, opts, globals);
+}
+export function contactsDeleteCommand(idArgs, globals) {
+    return deleteCommand(mailingContact, idArgs, globals);
+}
+export async function tracesListCommand(opts, globals) {
+    const client = await authenticatedClient(globals);
+    await ModelFields.load(client, "mailing.trace"); // module-installed check
+    const domain = [];
+    if (opts.email)
+        domain.push(["email", "ilike", opts.email]);
+    if (opts.mailing) {
+        const mailing = await resolveReference(client, "mailing.mailing", opts.mailing, { label: "mailing" });
+        domain.push(["mass_mailing_id", "=", mailing.id]);
+    }
+    if (opts.state)
+        domain.push(["trace_status", "=", opts.state]);
+    if (opts.domain)
+        domain.push(...parseDomain(opts.domain));
+    return runList(mailingTrace, opts, domain, globals);
+}
+export function tracesShowCommand(idArg, opts, globals) {
+    return showCommand(mailingTrace, idArg, opts, globals);
+}
+export function tracesDeleteCommand(idArgs, globals) {
+    return deleteCommand(mailingTrace, idArgs, globals);
+}

package/dist/commands/messages.js

@@ -0,0 +1,309 @@
+import { authenticatedClient, parseId, showCommand, } from "../resource.js";
+import { usageError } from "../errors.js";
+import { printJson } from "../output.js";
+import { parseDomain } from "../filter.js";
+/**
+ * mail.message surface, erasure-scoped. Chatter attaches to every model
+ * (res.partner, helpdesk.ticket, crm.lead, ...), so `list` REQUIRES an
+ * explicit scope (--res-model / --res-id) and `scrub`/`delete` REQUIRE BOTH
+ * and cross-check every id against it — a message on another record is
+ * skipped, never touched. Bodies are excluded from `list` output (metadata
+ * plus lengths only); `show` reads the body for the single-record case.
+ *
+ * `scrub` implements the erasure SOP's tracked-change remediation: removing
+ * personal data from a record leaves a chatter `mail.message` whose
+ * `mail.tracking.value` rows carry the PRE-change values (old email, old
+ * name). Scrub unlinks those rows and rewrites the body to an erasure
+ * marker. The default marker is fixed SOP text (decision #1 discipline);
+ * `--marker` overrides it for message classes on other models, with two
+ * guardrails: plain text only (escaped, wrapped in a <p> block) and a hard
+ * refusal on email-shaped content — the residue this command exists to
+ * remove must never be re-embeddable through it.
+ */
+export const mailMessage = {
+    model: "mail.message",
+    showCommand: "odoo messages show",
+    defaultListFields: [
+        "id",
+        "model",
+        "res_id",
+        "message_type",
+        "subtype_id",
+        "author_id",
+        "date",
+    ],
+    showExtraFields: ["body", "email_from", "tracking_value_ids"],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+/** SOP-verbatim default; a variant is a decision (TDD), not a flag value. */
+export const ERASURE_BODY_MARKER = "<p>Partner anonymized (erasure flow)</p>";
+const MARKER_MAX_LENGTH = 1000;
+const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
+function parseCount(raw, flag) {
+    if (!/^\d+$/.test(raw)) {
+        throw usageError(`invalid ${flag} value ${JSON.stringify(raw)}`, "expected a non-negative integer");
+    }
+    return Number(raw);
+}
+function parseScope(resModel, resId, flags) {
+    if (resModel === undefined || resId === undefined) {
+        throw usageError(`${flags} requires both --res-model and --res-id`, "the scope cross-check must fully qualify the parent record — combine 'messages list --res-model X --res-id Y' with 'messages scrub/delete <ids> --res-model X --res-id Y'");
+    }
+    return { resModel, resId: parseCount(resId, "--res-id") };
+}
+function resolveMarker(opts) {
+    const raw = opts.marker?.trim();
+    if (raw === undefined || raw === "")
+        return ERASURE_BODY_MARKER;
+    if (raw.length > MARKER_MAX_LENGTH) {
+        throw usageError("--marker exceeds the 1000 character limit", "markers are short annotations; the erasure register holds the details");
+    }
+    if (EMAIL_PATTERN.test(raw)) {
+        throw usageError("--marker contains an email-shaped token", "scrub exists to remove personal data from chatter; a marker that can carry an email address re-creates the residue through the remediation itself. Name the record by id, never by address");
+    }
+    const escaped = raw
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+    return `<p>${escaped}</p>`;
+}
+function scopeMismatch(rec, scope) {
+    return rec.model !== scope.resModel || rec.res_id !== scope.resId;
+}
+export async function messagesListCommand(opts, globals) {
+    const client = await authenticatedClient(globals);
+    const resId = opts.resId !== undefined ? parseCount(opts.resId, "--res-id") : undefined;
+    // Scope guard: mail.message is a global chatter table across every
+    // model; never browse it unbounded (PII read footgun).
+    if (opts.resModel === undefined && resId === undefined) {
+        throw usageError("messages list requires an explicit scope", "pass --res-model and --res-id (AND-ed); a model-only list is allowed but still large — prefer the pair");
+    }
+    const limit = parseCount(opts.limit, "--limit");
+    const offset = parseCount(opts.offset, "--offset");
+    const domain = [];
+    if (opts.resModel !== undefined)
+        domain.push(["model", "=", opts.resModel]);
+    if (resId !== undefined)
+        domain.push(["res_id", "=", resId]);
+    if (opts.domain)
+        domain.push(...parseDomain(opts.domain));
+    const readFields = Array.from(new Set([...mailMessage.defaultListFields, "body", "tracking_value_ids"]));
+    const order = opts.order ?? "id asc";
+    const [records, count] = await Promise.all([
+        client.executeKw("mail.message", "search_read", [domain], {
+            fields: readFields,
+            limit,
+            offset,
+            order,
+        }),
+        client.executeKw("mail.message", "search_count", [
+            domain,
+        ]),
+    ]);
+    // Body content never leaves the command in list output — length only.
+    const rows = records.map((rec) => {
+        const body = rec.body;
+        const row = { ...rec };
+        delete row.body;
+        row.body_length =
+            typeof body === "string" && body.length > 0 ? body.length : 0;
+        const tv = rec.tracking_value_ids;
+        row.tracking_values = Array.isArray(tv) ? tv.length : 0;
+        delete row.tracking_value_ids;
+        return row;
+    });
+    if (globals.json) {
+        printJson({ model: "mail.message", records: rows, count, limit, offset });
+        return;
+    }
+    const headers = [
+        "id",
+        "model",
+        "res_id",
+        "message_type",
+        "author_id",
+        "date",
+        "body_length",
+        "tracking_values",
+    ];
+    const human = records.map((rec) => {
+        const body = rec.body;
+        const tv = rec.tracking_value_ids;
+        return [
+            String(rec.id ?? ""),
+            String(rec.model ?? ""),
+            String(rec.res_id ?? ""),
+            String(rec.message_type ?? ""),
+            String(Array.isArray(rec.author_id) ? rec.author_id[1] : (rec.author_id ?? "")),
+            String(rec.date ?? ""),
+            String(typeof body === "string" && body.length > 0 ? body.length : 0),
+            String(Array.isArray(tv) ? tv.length : 0),
+        ];
+    });
+    const widths = headers.map((h, i) => Math.max(h.length, ...human.map((r) => r[i].length)));
+    const fmt = (cells) => cells
+        .map((c, i) => c.padEnd(widths[i]))
+        .join("  ")
+        .trimEnd();
+    const lines = [fmt(headers), ...human.map(fmt)];
+    process.stdout.write(lines.join("\n") + "\n");
+}
+export function messagesShowCommand(idArg, opts, globals) {
+    return showCommand(mailMessage, idArg, opts, globals);
+}
+/**
+ * Strip tracked-change residue from in-scope messages: unlink every
+ * mail.tracking.value row (they hold the pre-change values) and rewrite the
+ * body to the erasure marker. Messages without tracking rows are skipped —
+ * this command never rewrites arbitrary chatter uninvited; the explicit
+ * weapon for verified personal data in message bodies is `messages delete`.
+ */
+export async function messagesScrubCommand(idArgs, opts, globals) {
+    const client = await authenticatedClient(globals);
+    const scope = parseScope(opts.resModel, opts.resId, "messages scrub");
+    const ids = idArgs.map((a) => parseId(a));
+    const marker = resolveMarker(opts);
+    const records = (await client.executeKw("mail.message", "read", [ids], {
+        fields: ["model", "res_id", "tracking_value_ids"],
+    }));
+    const scrubbed = [];
+    const skipped = [];
+    for (const id of ids) {
+        const rec = records.find((r) => r.id === id);
+        if (!rec) {
+            skipped.push({ id, reason: "not found" });
+            continue;
+        }
+        if (scopeMismatch(rec, scope)) {
+            skipped.push({
+                id,
+                reason: `scope mismatch (message is on ${rec.model}/${rec.res_id})`,
+            });
+            continue;
+        }
+        const tv = Array.isArray(rec.tracking_value_ids)
+            ? rec.tracking_value_ids
+            : [];
+        if (tv.length === 0) {
+            skipped.push({ id, reason: "no tracking values" });
+            continue;
+        }
+        // Field NAMES only — old/new values are the residue being removed and
+        // must never echo back through command output, not even in dry-run.
+        const tvRows = (await client.executeKw("mail.tracking.value", "read", [[...tv]], { fields: ["field_id", "field_info"] }));
+        const fieldNames = tvRows.map((tvRow) => {
+            const info = tvRow.field_info;
+            if (info && typeof info === "object" && "name" in info) {
+                return String(info.name);
+            }
+            const f = tvRow.field_id;
+            return Array.isArray(f) ? String(f[1]) : String(f ?? "unknown");
+        });
+        if (globals.dryRun) {
+            scrubbed.push({
+                id,
+                trackingRows: tv.length,
+                fields: fieldNames,
+                marker,
+            });
+            continue;
+        }
+        await client.executeKw("mail.tracking.value", "unlink", [tv]);
+        // In production Odoo the unlink cascades the m2m; clear it explicitly so
+        // the message row itself no longer dangles (and so test servers see the
+        // same end state).
+        await client.executeKw("mail.message", "write", [
+            [id],
+            { tracking_value_ids: [[6, 0, []]] },
+        ]);
+        await client.executeKw("mail.message", "write", [[id], { body: marker }]);
+        scrubbed.push({
+            id,
+            trackingRowsRemoved: tv.length,
+            fields: fieldNames,
+            marker,
+        });
+    }
+    if (globals.json) {
+        printJson({
+            model: "mail.message",
+            scope,
+            marker,
+            scrubbed,
+            skipped,
+            removedTrackingRows: scrubbed.reduce((n, s) => n + Number(s.trackingRowsRemoved ?? s.trackingRows ?? 0), 0),
+        });
+        return;
+    }
+    for (const s of scrubbed) {
+        const fields = s.fields ?? [];
+        if (globals.dryRun) {
+            process.stdout.write(`Would scrub mail.message ${s.id}: remove ${s.trackingRows} tracking row(s) [${fields.join(", ")}], set marker\n`);
+        }
+        else {
+            process.stdout.write(`Scrubbed mail.message ${s.id}: removed ${s.trackingRowsRemoved} tracking row(s) [${fields.join(", ")}], marker written\n`);
+        }
+    }
+    for (const s of skipped) {
+        process.stdout.write(`Skipping mail.message ${s.id}: ${s.reason}\n`);
+    }
+    if (!globals.dryRun && scrubbed.length > 0) {
+        process.stdout.write(`Done — verify with: odoo messages list --res-model ${scope.resModel} --res-id ${scope.resId} --json (tracking_values must be 0)`);
+    }
+    process.stdout.write("\n");
+}
+/**
+ * Delete in-scope messages outright. This is the §6/escalation weapon for
+ * verified personal data in message bodies (after the SQL/checks confirmed
+ * it) — distinct from `scrub`, which annotates tracked-change residue while
+ * keeping the accountability trail.
+ */
+export async function messagesDeleteCommand(idArgs, opts, globals) {
+    const client = await authenticatedClient(globals);
+    const scope = parseScope(opts.resModel, opts.resId, "messages delete");
+    const ids = idArgs.map((a) => parseId(a));
+    const records = (await client.executeKw("mail.message", "read", [ids], {
+        fields: ["model", "res_id"],
+    }));
+    const deleted = [];
+    const skipped = [];
+    for (const id of ids) {
+        const rec = records.find((r) => r.id === id);
+        if (!rec) {
+            skipped.push({ id, reason: "not found" });
+            continue;
+        }
+        if (scopeMismatch(rec, scope)) {
+            skipped.push({
+                id,
+                reason: `scope mismatch (message is on ${rec.model}/${rec.res_id})`,
+            });
+            continue;
+        }
+        deleted.push(id);
+    }
+    if (!globals.dryRun && deleted.length > 0) {
+        await client.executeKw("mail.message", "unlink", [deleted]);
+    }
+    if (globals.json) {
+        printJson({
+            model: "mail.message",
+            scope,
+            ...(globals.dryRun ? { wouldDelete: deleted } : { deleted }),
+            skipped,
+        });
+        return;
+    }
+    for (const id of deleted) {
+        process.stdout.write(globals.dryRun
+            ? `Would delete mail.message ${id}\n`
+            : `Deleted mail.message ${id}\n`);
+    }
+    for (const s of skipped) {
+        process.stdout.write(`Skipping mail.message ${s.id}: ${s.reason}\n`);
+    }
+    process.stdout.write("\n");
+}

package/dist/commands/users.js

@@ -0,0 +1,58 @@
+import { ModelFields } from "../model.js";
+import { authenticatedClient, parseId, showCommand, } from "../resource.js";
+import { deleteCommand } from "../mutation.js";
+import { conflictError } from "../errors.js";
+/**
+ * res.users surface (sign-in identities). Deliberately narrow: `show` and a
+ * guarded `delete` — no list, no create/update. `res.users` holds internal
+ * accounts (employees, service accounts) that must never be removed via the
+ * CLI, so `users delete` enforces portal-only (`share=true`) always:
+ * any internal user in the batch aborts the whole command without deleting
+ * anything (see docs/plans/users-module.md §5).
+ */
+export const resUsers = {
+    model: "res.users",
+    showCommand: "odoo users show",
+    defaultListFields: [
+        "id",
+        "login",
+        "email",
+        "name",
+        "share",
+        "active",
+        "partner_id",
+    ],
+    showExtraFields: ["company_id", "create_date", "login_date", "write_date"],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+export function usersShowCommand(idArg, opts, globals) {
+    return showCommand(resUsers, idArg, opts, globals);
+}
+/**
+ * Portal-only delete: read `share` for every requested id first (missing
+ * ids are absent from the response and left for deleteCommand's skipped
+ * reporting), and refuse the entire batch when any id is an internal user
+ * (`share=false`). There is no override flag by design.
+ */
+export async function usersDeleteCommand(idArgs, globals) {
+    const ids = idArgs.map(parseId);
+    const client = await authenticatedClient(globals);
+    // fields_get first: doubles as the module/model presence check (§1).
+    await ModelFields.load(client, resUsers.model);
+    if (ids.length > 0) {
+        const rows = (await client.executeKw("res.users", "read", [ids], {
+            fields: ["share", "login", "name"],
+        }));
+        const internal = rows.filter((r) => r.share !== true);
+        if (internal.length > 0) {
+            const named = internal
+                .map((r) => `${r.id} (${r.login || r.name || "unknown login"})`)
+                .join(", ");
+            throw conflictError("protected_record", `internal user(s) cannot be deleted via the CLI: ${named}`, "users delete only removes portal users (share=true); internal accounts are managed in the Odoo UI");
+        }
+    }
+    return deleteCommand(resUsers, idArgs, globals);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bergetai/odoo-cli",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "description": "Agent-first CLI for the Odoo External API",
   "publishConfig": {
     "access": "public"