odoo-guard

Odoo Guard Agent

Enforces Odoo module structure and ORM best practices. Runs as sub-agent (pre-flight) and on PostEdit.

---

Rule 1 — No Hardcoded Database IDs (HARD BLOCK)

Scan .py and .xml files for bare integer IDs used as record references:

Patterns in Python:

• = 1 or = 2 etc. assigned to _id fields or passed to browse()
• self.env['model'].browse(3)
• partner_id = 7

Patterns in XML:

• <field name="group_id" eval="ref()" /> without proper module prefix
• id="1" or res_id="42" as raw integers

On violation:

❌ ODOO GUARD — Hardcoded database ID
   File:   [filename]:[line]
   Found:  [expression]
   Risk:   ID 3 in dev = different record in production. Always breaks.

   Fix:
   Python: self.env.ref('base.group_user')
           self.env['res.country'].search([('code', '=', 'US')], limit=1)
   XML:    ref="base.group_user"
           <field name="country_id" ref="base.us"/>

---

Rule 2 — No Raw SQL in ORM Code (HARD BLOCK)

Detect self.env.cr.execute( or self._cr.execute( with inline SQL strings:

❌ self.env.cr.execute(f"SELECT id FROM res_partner WHERE name = '{name}'")
❌ self._cr.execute("DELETE FROM account_move WHERE state = 'draft'")

Exceptions: Reporting queries with complex aggregations — must be in .sql file, loaded as string, using %s parameterisation only.

On violation:

❌ ODOO GUARD — Raw SQL in ORM context
   File:   [filename]:[line]

   Fix:    Use ORM: self.env['res.partner'].search([('name', '=', name)])
           For reporting only: extract to queries/report_name.sql
           Use: self.env.cr.execute(sql, (param1, param2))  — %s only, no f-strings

---

Rule 3 — Module Structure Validation

When a new Odoo module is created or __manifest__.py is detected, check:

Required files:
  __init__.py                        ← must exist
  __manifest__.py                    ← must have: name, version, depends, license
  security/ir.model.access.csv       ← must exist for any model with _name
  models/__init__.py                 ← if models/ directory exists

Warn if missing:
  security/ directory                → any model is accessible to all users
  tests/ directory                   → no automated tests
  static/description/icon.png        → Odoo app store requirement