From dcf8775cbcabd612e11e36de969e3767ba1d3775 Mon Sep 17 00:00:00 2001
From: chga-odoo <chga@odoo.com>
Date: Tue, 7 Jul 2026 15:23:40 +0530
Subject: [PATCH] [IMP] booking_channex: introduce hotel manager security group

- Restrict Channex configuration to System Administrators.
- Restrict internal Channex custom models to System Administrators.

Task: 6174469
---
 booking_channex/data/ir_model_access.xml    | 14 ++------------
 booking_engine/data/res_config_settings.xml |  2 +-
 2 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/booking_channex/data/ir_model_access.xml b/booking_channex/data/ir_model_access.xml
index 2c1e4ff6d3..db6b206615 100644
--- a/booking_channex/data/ir_model_access.xml
+++ b/booking_channex/data/ir_model_access.xml
@@ -1,8 +1,7 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <odoo>
-    <!-- TODO add security here -->
     <record id="x_channex_mapping_access" model="ir.model.access">
-        <field name="group_id" ref="base.group_user"/>
+        <field name="group_id" ref="base.group_system"/>
         <field name="model_id" ref="x_channex_mapping_model"/>
         <field name="name">x_channex_mapping_user_access</field>
         <field name="perm_create" eval="True"/>
@@ -11,7 +10,7 @@
         <field name="perm_write" eval="True"/>
     </record>
     <record id="x_channex_ari_update_lines_access" model="ir.model.access">
-        <field name="group_id" ref="base.group_user"/>
+        <field name="group_id" ref="base.group_system"/>
         <field name="model_id" ref="x_channex_ari_update_lines_model"/>
         <field name="name">x_channex_ari_update_lines_user_access</field>
         <field name="perm_create" eval="True"/>
@@ -19,15 +18,6 @@
         <field name="perm_unlink" eval="True"/>
         <field name="perm_write" eval="True"/>
     </record>
-    <record id="x_rate_plan_access" model="ir.model.access">
-        <field name="group_id" ref="base.group_user"/>
-        <field name="model_id" ref="x_rate_plan_model"/>
-        <field name="name">x_rate_plan_user_access</field>
-        <field name="perm_create" eval="False"/>
-        <field name="perm_read" eval="True"/>
-        <field name="perm_unlink" eval="False"/>
-        <field name="perm_write" eval="False"/>
-    </record>
     <record id="x_rate_plan_system_access" model="ir.model.access">
         <field name="group_id" ref="base.group_system"/>
         <field name="model_id" ref="x_rate_plan_model"/>
diff --git a/booking_engine/data/res_config_settings.xml b/booking_engine/data/res_config_settings.xml
index 27a4799a11..c7fda96bff 100644
--- a/booking_engine/data/res_config_settings.xml
+++ b/booking_engine/data/res_config_settings.xml
@@ -234,7 +234,7 @@ if module:
                             </div>
                         </setting>
                     </block>
-                    <block title="Channel Manager" name="channel_manager_config_block" >
+                    <block title="Channel Manager" name="channel_manager_config_block" groups="base.group_system">
                         <setting id="booking_engine_channel_manager_setting" help="Expose your stay offers on OTAs through channex.">
                             <field name="x_module_channel_manager" groups="base.group_system"/>
                             <div class="text-warning mb4" invisible="not x_module_channel_manager">