Odoo 19 Privilege System:
Migrating from category_id to privilege_id

#!/usr/bin/env python3
"""
Odoo 19 Privilege Migration Audit Script
Scans custom modules for deprecated category_id references
and groups missing privilege_id assignments.

Usage:
    python privilege_audit.py /path/to/custom/addons
"""
import os
import sys
import re
from lxml import etree

DEPRECATED_PATTERNS = [
    re.compile(r'name=["\']category_id["\']'),
    re.compile(r'base\.module_category_'),
    re.compile(r"\.category_id\s*="),
    re.compile(r"\bcategory_id\b.*\bref="),
]

SECURITY_FILE_PATTERNS = [
    "**/security/*.xml",
    "**/data/*security*.xml",
    "**/data/*groups*.xml",
]


def scan_xml_files(addons_path):
    """Scan all XML files for deprecated category_id refs."""
    issues = []
    for root, dirs, files in os.walk(addons_path):
        # Skip non-custom / OCA standard paths
        if '.git' in root or '__pycache__' in root:
            continue
        for fname in files:
            if not fname.endswith('.xml'):
                continue
            fpath = os.path.join(root, fname)
            with open(fpath, 'r', encoding='utf-8',
                      errors='ignore') as f:
                content = f.read()

            for i, pattern in enumerate(DEPRECATED_PATTERNS):
                for match in pattern.finditer(content):
                    line_no = (content[:match.start()]
                               .count('\n') + 1)
                    issues.append({
                        'file': os.path.relpath(fpath,
                                                addons_path),
                        'line': line_no,
                        'match': match.group(),
                        'type': 'xml' if i < 2 else 'python',
                    })
    return issues


def scan_python_files(addons_path):
    """Scan Python files for ORM category_id usage."""
    issues = []
    py_patterns = [
        re.compile(
            r"""['"]category_id['"]\s*[,\)]"""
        ),
        re.compile(r"\.category_id\b"),
    ]
    for root, dirs, files in os.walk(addons_path):
        if '.git' in root or '__pycache__' in root:
            continue
        for fname in files:
            if not fname.endswith('.py'):
                continue
            fpath = os.path.join(root, fname)
            with open(fpath, 'r', encoding='utf-8',
                      errors='ignore') as f:
                for line_no, line in enumerate(f, 1):
                    for pat in py_patterns:
                        if pat.search(line):
                            issues.append({
                                'file': os.path.relpath(
                                    fpath, addons_path),
                                'line': line_no,
                                'match': line.strip()[:80],
                                'type': 'python',
                            })
    return issues


def scan_groups_without_privilege(addons_path):
    """Find res.groups records missing privilege_id."""
    missing = []
    for root, dirs, files in os.walk(addons_path):
        if '.git' in root:
            continue
        for fname in files:
            if not fname.endswith('.xml'):
                continue
            fpath = os.path.join(root, fname)
            try:
                tree = etree.parse(fpath)
            except etree.XMLSyntaxError:
                continue
            for record in tree.xpath(
                "//record[@model='res.groups']"
            ):
                rec_id = record.get('id', '(no id)')
                has_privilege = any(
                    f.get('name') == 'privilege_id'
                    for f in record.findall('field')
                )
                has_category = any(
                    f.get('name') == 'category_id'
                    for f in record.findall('field')
                )
                if not has_privilege:
                    missing.append({
                        'file': os.path.relpath(
                            fpath, addons_path),
                        'record_id': rec_id,
                        'has_old_category': has_category,
                    })
    return missing


def main():
    if len(sys.argv) < 2:
        print("Usage: python privilege_audit.py "
              "/path/to/addons")
        sys.exit(1)

    addons_path = sys.argv[1]
    print(f"Scanning: {addons_path}\n")

    # Phase 1: Deprecated references
    xml_issues = scan_xml_files(addons_path)
    py_issues = scan_python_files(addons_path)
    all_issues = xml_issues + py_issues

    print(f"{'='*60}")
    print(f" DEPRECATED category_id REFERENCES")
    print(f"{'='*60}")
    if all_issues:
        for issue in all_issues:
            print(f"  [{issue['type'].upper():6s}] "
                  f"{issue['file']}:{issue['line']}")
            print(f"           {issue['match']}")
        print(f"\n  Total: {len(all_issues)} reference(s) "
              f"to migrate.\n")
    else:
        print("  No deprecated references found.\n")

    # Phase 2: Missing privilege_id
    missing = scan_groups_without_privilege(addons_path)

    print(f"{'='*60}")
    print(f" GROUPS MISSING privilege_id")
    print(f"{'='*60}")
    if missing:
        for m in missing:
            status = (" (has category_id → MIGRATE)"
                      if m['has_old_category']
                      else " (no category at all → ADD)")
            print(f"  {m['file']}")
            print(f"    record: {m['record_id']}{status}")
        print(f"\n  Total: {len(missing)} group(s) need "
              f"privilege_id.\n")
    else:
        print("  All groups have privilege_id.\n")

    # Summary
    total = len(all_issues) + len(missing)
    if total == 0:
        print("All clear — your modules are Odoo 19 "
              "privilege-ready.")
    else:
        print(f"ACTION REQUIRED: {total} issue(s) found. "
              f"Fix before upgrading.")
    return 1 if total else 0


if __name__ == '__main__':
    sys.exit(main())