[18.0] Add base_debug_restricted (restrict Debug Mode with a group)

base_debug_restricted/README.rst

@@ -0,0 +1,93 @@
+================
+Restricted Debug
+================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:d51921203310af24e1b7eed7ad5f9d46e918d7f844254488a93dc99fb9b5dd1a
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/licence-LGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
+    :alt: License: LGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--backend-lightgray.png?logo=github
+    :target: https://github.com/OCA/server-backend/tree/18.0/base_debug_restricted
+    :alt: OCA/server-backend
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/server-backend-18-0/server-backend-18-0-base_debug_restricted
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/server-backend&target_branch=18.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+This module restricts the usage of Debug Mode to selected users.
+
+By default, Debug Mode is even available to public users on the web
+part. When enabled and an error is raised, the public user will see a
+detailed error page with the traceback and file paths. It discloses
+information about the server, which may be avoided.
+
+After installing this module, only connected users with the "Debug Mode"
+role will be able to enable the Debug Mode and see detailed error pages.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Usage
+=====
+
+Add the "Debug Mode" group to the users who should have access to Debug
+Mode.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-backend/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/server-backend/issues/new?body=module:%20base_debug_restricted%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* QoQa
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+.. |maintainer-guewen| image:: https://github.com/guewen.png?size=40px
+    :target: https://github.com/guewen
+    :alt: guewen
+
+Current `maintainer <https://odoo-community.org/page/maintainer-role>`__:
+
+|maintainer-guewen| 
+
+This module is part of the `OCA/server-backend <https://github.com/OCA/server-backend/tree/18.0/base_debug_restricted>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

base_debug_restricted/__init__.py

@@ -0,0 +1 @@
+from . import models

base_debug_restricted/__manifest__.py

@@ -0,0 +1,17 @@
+# Copyright 2026 QoQa
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl).
+
+{
+    "name": "Restricted Debug",
+    "version": "18.0.1.0.0",
+    "category": "Tools",
+    "author": "QoQa, Odoo Community Association (OCA)",
+    "license": "LGPL-3",
+    "maintainers": ["guewen"],
+    "website": "https://github.com/OCA/server-backend",
+    "depends": ["web"],
+    "data": [
+        "data/res_groups.xml",
+    ],
+    "installable": True,
+}

base_debug_restricted/data/res_groups.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo>
+    <record id="group_debug_mode" model="res.groups">
+        <field name="name">Debug Mode</field>
+        <field name="category_id" ref="base.module_category_hidden" />
+        <field
+            name="users"
+            eval="[Command.link(ref('base.user_root')), Command.link(ref('base.user_admin'))]"
+        />
+    </record>
+</odoo>

base_debug_restricted/models/__init__.py

@@ -0,0 +1 @@
+from . import ir_http

base_debug_restricted/models/ir_http.py

@@ -0,0 +1,28 @@
+# Copyright 2026 QoQa
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl).
+
+from odoo import models
+from odoo.http import request
+
+
+class Http(models.AbstractModel):
+    _inherit = "ir.http"
+
+    @classmethod
+    def _handle_debug(cls):
+        if request.httprequest.args.get("debug") is None:
+            return
+
+        if not cls._debug_mode_allowed_users():
+            request.session.debug = ""
+            return
+
+        return super()._handle_debug()
+
+    @classmethod
+    def _debug_mode_allowed_users(cls):
+        if not request.session.uid:
+            # always disallowed in public
+            return False
+        user = request.env["res.users"].browse(request.session.uid)
+        return user.sudo().has_group("base_debug_restricted.group_debug_mode")

base_debug_restricted/pyproject.toml

@@ -0,0 +1,3 @@
+[build-system]
+requires = ["whool"]
+build-backend = "whool.buildapi"

base_debug_restricted/readme/DESCRIPTION.md

@@ -0,0 +1,9 @@
+This module restricts the usage of Debug Mode to selected users.
+
+By default, Debug Mode is even available to public users on the web part. When
+enabled and an error is raised, the public user will see a detailed error page with
+the traceback and file paths. It discloses information about the server, which
+may be avoided.
+
+After installing this module, only connected users with the "Debug Mode" role
+will be able to enable the Debug Mode and see detailed error pages.

base_debug_restricted/readme/USAGE.md

@@ -0,0 +1 @@
+Add the "Debug Mode" group to the users who should have access to Debug Mode.