- Remove all debug logging and statements for production deployment
- Convert operational logging from info to debug level where appropriate
- Clean up debug test files and commented code
- Refactor access control helpers into centralized AccessControlMixin
- Consolidate duplicated access control methods across controllers
- Enforce team-based access control for all portal users
- Fix access control logic to match expected security behavior
- Move TODO.md to notes/ directory for better organization
- All 76 tests passing with proper security enforcement
Production ready: Clean codebase with centralized access control and no debug noise
- Implement context-sensitive assignee column display in activity views
- Show assignee column only when viewing specific records (teams, patients, injuries)
- Hide assignee column in general 'My Activities' view (users only see their own activities)
- Add reassignment modal with dropdown to select new treatment professional
- Implement /my/activity/reassign controller route with proper access control
- Add team-based security validation for reassignment operations
- Fix template variable passing issue where show_assignee wasn't reaching activity_list_table
- Add success feedback and proper return URL handling after reassignment
- Maintain context-sensitive activity filtering for optimal user experience
- All tests passing (76 tests, 0 failed, 0 errors)
This enhancement improves team coordination by providing clear visibility of activity
assignments and easy reassignment capabilities while maintaining proper security boundaries.
- Fix ACL test assumptions about browse() behavior
* Update tests to check field-level access instead of browse().exists()
* Correct test methodology for AccessError validation
- Implement buddy method pattern for RPC security
* Refactor all sudo()/api.model methods to use public/private pattern
* Public methods perform access checks, private methods contain privileged ops
* Prevents RPC privilege escalation vulnerabilities
- Enhanced security architecture
* Add comprehensive mail activity portal access rules
* Strengthen partner access controls
* Update controller method references to use secure public methods
- Test suite improvements
* Add extensive mail activity portal access tests
* Update player removal tests to use public method interfaces
* Improve test coverage for security scenarios
- Security best practices enforcement
* All privileged operations now encapsulated in private methods
* Clear separation between public API and internal operations
* Maintains functionality while securing RPC access
Resolves RPC security vulnerabilities and establishes proper ACL enforcement patterns.
- Refactor portal templates to eliminate intra-module template inheritance
- Integrate emergency contacts section into player injuries template
- Add full internal admin views for treatment notes with chatter support
- Fix ORM warning in test_rights by using proper ORM commands
- Update manifest to reflect new functionality (v18.0.1.9.0)
This refactoring improves template stability by removing XPath errors and
provides treatment professionals with better access to emergency contacts
and treatment notes both in portal and backend interfaces.
Timezone differences were causing dates to come up very weirdly on new
patient injury records. They now use the user timezone to convert
datetime.now() appropriately.
Added two mail.message.subtypes to notify all followers of updates to
patient status and changes to injury fields. Added a post-migration
script to update all existing followers to subscribe to these new
subtypes.
Kanban view added for players to improve the experience when browsing on
mobile. Card text color synchronized with what the user expects from the
list view.
Allows portal users to see the full diagnosis and notes. Previously,
diagnosis was truncated if it went beyond the bounds of the column.
Also, notes are now shown in HTML instead of HTML escaped to text.
Kanban view added for players to improve the experience when browsing on
mobile. Card text color synchronized with what the user expects from the
list view.
Allows portal users to see the full diagnosis and notes. Previously,
diagnosis was truncated if it went beyond the bounds of the column.
Also, notes are now shown in HTML instead of HTML escaped to text.
