Describe your changes

Author: John75SunCity

HTTP Controller

@@ -1 +1,47 @@
+from odoo import http
+from odoo.http import request
+import logging
+
+_logger = logging.getLogger(__name__)
+
+CUSTOMER_FIELD = 'customer_id'
+INTERNAL_USAGE = 'internal'
+
+
+class MyController(http.Controller):
+
+    def _get_partner_inventory(self, partner):
+        serials = request.env['stock.production.lot'].search([(CUSTOMER_FIELD, '=', partner.id)])
+        return request.env['stock.quant'].search([
+            ('lot_id', 'in', serials.ids),
+            ('location_id.usage', '=', INTERNAL_USAGE)
+        ])
+
+    @http.route('/my/inventory/request_pickup', type='http', auth='user', methods=['POST'], csrf=True)
+    def request_pickup(self, **kw):
+        user = request.env.user
+        partner = user.partner_id
+        _logger.info('Inventory accessed by partner %s', partner.id)
+        try:
+            item_ids = [int(id) for id in request.httprequest.form.getlist('item_ids')]
+        except ValueError:
+            _logger.warning("User %s (ID: %s) provided invalid item_ids: %s", user.login, user.id, request.httprequest.form.getlist('item_ids'))
+            return request.redirect('/my/inventory?error=invalid_item_ids')
+        _logger.info('Pickup requested for items %s by partner %s', item_ids, partner.id)
+        # ...existing code...
+
+    @http.route('/my/inventory', type='http', auth='user', website=True, methods=['GET'], csrf=True)
+    def my_inventory(self, **kw):
+        user = request.env.user
+        partner = user.partner_id
+        quants = self._get_partner_inventory(partner)
+        return request.render(
+            'records_management.inventory_template',
+            {
+                'quants': quants,
+                'message': 'No inventory items found.' if not quants else ''
+            }
+        )
+
+    # ...existing code...
 

models

@@ -4,7 +4,12 @@
 class InventoryPortal(http.Controller):
     @http.route('/my/inventory', type='http', auth='user', website=True)
     def inventory(self, **kw):
+        # Authorization check
+        if not request.env.user.has_group('records_management.group_inventory_access'):
+            return request.redirect('/web/login?error=access_denied')
         partner = request.env.user.partner_id
+        if not partner:
+            return request.redirect('/my/inventory?error=partner_not_found')
         serials = request.env['stock.production.lot'].search([('customer_id', '=', partner.id)])
         quants = request.env['stock.quant'].search([
             ('lot_id', 'in', serials.ids), 
@@ -14,8 +19,15 @@ def inventory(self, **kw):
 
     @http.route('/my/request_pickup', type='http', auth='user', website=True, methods=['POST'])
     def request_pickup(self, **post):
+        # Authorization check
+        if not request.env.user.has_group('records_management.group_inventory_access'):
+            return request.redirect('/web/login?error=access_denied')
         partner = request.env.user.partner_id
+        if not partner:
+            return request.redirect('/my/inventory?error=partner_not_found')
         item_ids = [int(id) for id in request.httprequest.form.getlist('item_ids')]
+        if not item_ids:
+            return request.redirect('/my/inventory?error=no_items_selected')
         items = request.env['stock.production.lot'].search([
             ('id', 'in', item_ids),
             ('customer_id', '=', partner.id)

records_management/controllers/portal.py

@@ -8,3 +8,14 @@ class StockProductionLot(models.Model):
         string='Customer',
         help='Tracks ownership. Customer-owned items (boxes, files) have a customer_id; company-owned bins may leave it empty or use it for assignment.'
     )
+
+    # Developer Note:
+    # To optimize database queries, prefer using search_read or read_group instead of multiple .search() calls.
+    # Example:
+    # serials = request.env['stock.production.lot'].search_read(
+    #     [('customer_id', '=', partner.id)], ['id']
+    # )
+    # quants = request.env['stock.quant'].search_read(
+    #     [('lot_id', 'in', [s['id'] for s in serials]), ('location_id.usage', '=', 'internal')],
+    #     ['id', 'lot_id', 'location_id']
+    # )