- Replace the Phase-0 "content to be completed" placeholder Usage section
in every community_* README.rst with the actual features built across
Phases 1-6 (routes, crons, portal pages).
- Add CHANGELOG.rst (19.0.1.0.0) to every community_* module.
- Note independent-vs-bundled module relationships in the root README.
- Fix HANDOFF.md: Phase 8 was already committed (9a24691) and a git
remote is configured, contrary to what it still said; record 9-A
progress and the open gaps (missing banner.png assets, live
--test-enable suite not re-run this session, no v1.0.0 tag yet).
Reported: clicking "Post a Listing" on /classifieds while logged out threw
a raw 500 instead of prompting login.
Root cause is upstream, in this Odoo 19 build's own http.py: when
auth='user' raises SessionExpiredException for an anonymous visitor,
Request._serve_db's `finally: self.env = None` clears the request env
before the exception reaches the website error handler, which then tries
to build the login redirect via self.env['ir.http']._redirect(...) and
crashes with TypeError: 'NoneType' object is not subscriptable. This
isn't specific to any one route - it reproduces on every auth='user' +
website=True page hit anonymously, including stock Odoo's own /my (traced
this back to the true cause rather than continuing to treat it as an
unrelated environment quirk, since it now has a real reported symptom).
Since core can't be patched here, worked around it at the route level
across all 9 affected pages (classifieds new/my/renew, membership
my/renew/card, benefits my, school attendance, portal my/school, event
checkin): switched from auth='user' to auth='public' and added an
explicit `if request.env.user._is_public(): return request.redirect(...)`
check at the top of each handler, before Odoo's own auth layer ever gets
a chance to raise. The jsonrpc AJAX endpoints (attendance save, checkin
scan/dashboard) were left on auth='user' since they return a JSON error
rather than attempting an HTML redirect, so they don't hit this path.
Verified against a live Odoo 19 + Postgres 16 container: reproduced the
original crash pre-fix, then confirmed all 9 previously-broken routes now
303-redirect to /web/login?redirect=<path> when hit anonymously, that the
login page carries the redirect target, that logged-in access is
unaffected (200), and that the separate "logged in but lacking a required
group" case (event check-in without Registration Desk) still degrades
gracefully to a clean 403 rather than a crash. Full regression: 48/48
tests pass across the six touched modules.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
community_theme_base: brand tokens (primary/secondary/accent colour, logo,
heading/body font) exposed via res.config.settings, backed by
ir.config_parameter with a neutral default palette. A theme_css_vars QWeb
template renders them as CSS custom properties and is injected into both
website.layout (xpath into //head) and web.basic_layout (used by every
PDF report, including community_membership's card and event_qr_ticketing's
ticket) - so any deployment rebrands with data only. Confirmed env['model']
is accessible bare inside arbitrary QWeb templates (checked core usage in
web/report_templates.xml and website_templates.xml first) before relying
on it for the injection.
community_portal: extends portal.portal_my_home with cards for Membership,
Events, School, Benefits, and Classifieds, each gated by an inline
ir.module.module installed-check so a card is fully absent (not just
zero-count) when its module isn't installed - this is the piece that
finally wires up community_membership's membership_count counter, which
Session 1-C had already implemented but nothing was rendering yet. Adds
counters for the other four product modules (none of which had their own
portal home counter) and a new /my/school page listing a parent's
children's enrollments and attendance.
Verified against a live Odoo 19 + Postgres 16 container, automated (6
tests) and manually per the Phase 6 gate exactly: set a custom primary
colour via config parameter and confirmed it appears both on a real public
page (HttpCase hitting '/') and the live /my dashboard; then uninstalled
community_classifieds via button_immediate_uninstall and confirmed /my
still returned 200 with the "My Classifieds" card gone and no error,
before reinstalling it to restore the dev environment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Scaffolds the CommunityOS monorepo per the implementation plan: 8
brand-neutral product modules (community_theme_base, community_membership,
event_qr_ticketing, community_school, community_classifieds,
community_benefits, community_interac, community_portal) plus the
tncsc_deployment client layer, each with an App-Store-ready manifest,
LGPL-3 license, and empty security/data/demo/tests/views scaffolding.
Adds deploy/docker-compose.yml (Odoo 19 CE + Postgres 16), CI workflow
that installs all modules with --test-enable, and scripts/check_brand_leak.py
+ check_manifests.py enforcing the no-client-identity-in-product-code and
manifest-completeness rules. Verified locally: all 9 modules install clean
on a fresh Odoo 19 database, and the brand-leak check correctly fails when
a client term is added to a product module and passes once removed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
