[19.0][MIG] privacy_consent: Migration to 19.0

privacy_consent/README.rst

@@ -0,0 +1,187 @@
+.. image:: https://odoo-community.org/readme-banner-image
+   :target: https://odoo-community.org/get-involved?utm_source=readme
+   :alt: Odoo Community Association
+
+=================
+Privacy - Consent
+=================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:a1bc87f33b1755f112f2b02a4eed8fdf8576c046d801f3a73fd085f5c9de029f
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Production%2FStable-green.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Production/Stable
+.. |badge2| image:: https://img.shields.io/badge/license-AGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
+    :alt: License: AGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fdata--protection-lightgray.png?logo=github
+    :target: https://github.com/OCA/data-protection/tree/19.0/privacy_consent
+    :alt: OCA/data-protection
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/data-protection-19-0/data-protection-19-0-privacy_consent
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/data-protection&target_branch=19.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module allows the user to define a set of subjects (partners)
+affected by any data processing activity, and establish a process to ask
+them for consent to include them in that activity.
+
+For those that need explicit consent as a lawfulness base for personal
+data processing, as required by GDPR (article 6.1.a), this module
+provides the needed tools to automate it.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Installation
+============
+
+You may want to install, along with this module, one of OCA's
+``mail_tracking`` module collection, such as ``mail_tracking_mailgun``,
+so you can provide more undeniable proof that some consent request was
+sent, and to whom.
+
+However, the most important proof to provide is the answer itself (more
+than the question), and this addon provides enough tooling for that.
+
+Multi-database instances
+------------------------
+
+To enable multi-database support, you must load this addon as a
+server-wide addon. Example command to boot Odoo:
+
+::
+
+   odoo-bin --load=web,privacy_consent
+
+Usage
+=====
+
+New options for data processing activities:
+
+1. Go to *Privacy > Master Data > Activities* and create one.
+2. Give it a name, such as *Sending mass mailings to customers*.
+3. Go to tab *Consent* and choose one option in *Ask subjects for
+   consent*:
+
+   -  *Manual* tells the activity that you will want to create and send
+      the consent requests manually, and only provides some helpers for
+      you to be able to batch-generate them.
+   -  *Automatic* enables this module's full power: send all consent
+      requests to selected partners automatically, every day and under
+      your demand.
+
+4. When you do this, all the consent-related options appear. Configure
+   them:
+
+   -  A smart button tells you how many consents have been generated,
+      and lets you access them.
+
+   -  Choose one *Email template* to send to subjects. This email itself
+      is what asks for consent, and it gets recorded, to serve as a
+      proof that it was sent. The module provides a default template
+      that should be good for most usage cases; and if you create one
+      directly from that field, some good defaults are provided for your
+      comfortability.
+
+   -  *Subjects filter* defines what partners will be elegible for
+      inclusion in this data processing activity.
+
+   -  You can enable *Accepted by default* if you want to assume
+      subjects accepted their data processing. You should possibly
+      consult your lawyer to use this.
+
+   -  You can choose a *Server action* (developer mode only) that will
+      be executed whenever a new non-draft consent request is created,
+      or when its acceptance status changes.
+
+      This module supplies a server action by default, called *Update
+      partner's opt out*, that syncs the acceptance status with the
+      partner's *Elegible for mass mailings* option.
+
+5. Click on *Generate consent requests* link to create new consent
+   requests.
+
+   -  If you chose *Manual* mode, all missing consent request are
+      created as drafts, and nothing else is done now.
+   -  If you chose *Automatic* mode, also those request e-mails are
+      enqueued and, when the mail queue is cleared, they will be set as
+      *Sent*.
+
+6. You will be presented with the list of just-created consent requests.
+   See below.
+
+New options for consent requests:
+
+1. Access the consent requests by either:
+
+   -  Generating new consent requests from a data processing activity.
+   -  Pressing the *Consents* smart button in a data processing
+      activity.
+   -  Going to *Privacy > Privacy > Consents*.
+
+2. A consent will include the partner, the activity, the acceptance
+   status, and the request state.
+3. You can manually ask for consent by pressing the button labeled as
+   *Ask for consent*.
+4. All consent requests and responses are recorded in the mail thread
+   below.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/data-protection/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/data-protection/issues/new?body=module:%20privacy_consent%0Aversion:%2019.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* Tecnativa
+* initOS GmbH
+
+Contributors
+------------
+
+-  `Tecnativa <https://www.tecnativa.com>`__:
+
+   -  Jairo Llopis
+
+-  `initOS GmbH <https://www.initos.com>`__:
+
+   -  Florian Kantelberg
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+This module is part of the `OCA/data-protection <https://github.com/OCA/data-protection/tree/19.0/privacy_consent>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

privacy_consent/__init__.py

@@ -0,0 +1,2 @@
+from . import controllers
+from . import models

privacy_consent/__manifest__.py

@@ -0,0 +1,31 @@
+# Copyright 2018 Tecnativa - Jairo Llopis
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+{
+    "name": "Privacy - Consent",
+    "summary": "Allow people to explicitly accept or reject inclusion "
+    "in some activity, GDPR compliant",
+    "version": "19.0.1.0.0",
+    "development_status": "Production/Stable",
+    "category": "Privacy",
+    "website": "https://github.com/OCA/data-protection",
+    "author": "Tecnativa, initOS GmbH, Odoo Community Association (OCA)",
+    "license": "AGPL-3",
+    "application": False,
+    "installable": True,
+    "depends": ["privacy"],
+    "data": [
+        "security/ir.model.access.csv",
+        "data/ir_actions_server.xml",
+        "data/ir_cron.xml",
+        "data/mail.xml",
+        "templates/form.xml",
+        "views/privacy_consent.xml",
+        "views/privacy_activity.xml",
+        "views/res_partner.xml",
+    ],
+    "assets": {
+        "web.assets_frontend": [
+            "/privacy_consent/static/src/css/privacy_consent.scss",
+        ],
+    },
+}

privacy_consent/controllers/__init__.py

@@ -0,0 +1 @@
+from . import main

privacy_consent/controllers/main.py

@@ -0,0 +1,52 @@
+# Copyright 2018 Tecnativa - Jairo Llopis
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from datetime import datetime
+
+from markupsafe import Markup
+from werkzeug.exceptions import NotFound
+
+from odoo.http import Controller, request, route
+from odoo.tools import consteq
+
+
+class ConsentController(Controller):
+    @route(
+        "/privacy/consent/<any(accept,reject):choice>/<int:consent_id>/<token>",
+        type="http",
+        auth="public",
+        website=True,
+    )
+    def consent(self, choice, consent_id, token, *args, **kwargs):
+        """Process user's consent acceptance or rejection."""
+        consent = (
+            request.env["privacy.consent"]
+            .with_context(subject_answering=True)
+            .sudo()
+            .browse(consent_id)
+        )
+        if not (consent.exists() and consteq(consent._token(), token)):
+            raise NotFound
+        if consent.partner_id.lang:
+            request.update_context(lang=consent.partner_id.lang)
+        consent.action_answer(choice == "accept", self._metadata())
+        return request.render(
+            "privacy_consent.form",
+            {
+                "consent": consent,
+                "controller_name_html": Markup(
+                    consent.activity_id.controller_id.with_context(
+                        show_address=True, html_format=True
+                    ).display_name
+                ),
+            },
+        )
+
+    def _metadata(self):
+        return (
+            "User agent: {}\nRemote IP: {}\nDate and time: {:%Y-%m-%d %H:%M:%S}"
+        ).format(
+            request.httprequest.environ.get("HTTP_USER_AGENT"),
+            request.httprequest.environ.get("REMOTE_ADDR"),
+            datetime.now(),
+        )

privacy_consent/data/ir_actions_server.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!-- Copyright 2018 Tecnativa - Jairo Llopis
+     Copyright 2019 initOS GmbH - Florian Kantelberg
+     License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). -->
+<data>
+    <record id="sync_blacklist" model="ir.actions.server">
+        <field name="name">Sync partner's email blacklist status</field>
+        <field name="model_id" ref="model_privacy_consent" />
+        <field name="crud_model_id" ref="base.model_res_partner" />
+        <field name="state">code</field>
+        <field name="code">
+            for consent in records:
+                email = consent.partner_id.email
+                # Skip records without email, although highly improbable
+                if not email:
+                    continue
+                # Choose method to sync acceptance and blacklisting
+                if consent.accepted:
+                    method = env["mail.blacklist"]._remove
+                else:
+                    method = env["mail.blacklist"]._add
+                # Apply user desire
+                method(email)
+        </field>
+    </record>
+</data>

privacy_consent/data/ir_cron.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!-- Copyright 2018 Tecnativa - Jairo Llopis
+     Copyright 2019 initOS GmbH - Florian Kantelberg
+     License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). -->
+<data>
+    <record id="cron_auto_consent" model="ir.cron">
+        <field name="name">Request automatic data processing consents</field>
+        <field name="model_id" ref="model_privacy_activity" />
+        <field name="state">code</field>
+        <field name="code">model._cron_new_consents()</field>
+        <field name="interval_number">1</field>
+        <field name="interval_type">days</field>
+    </record>
+</data>