feat(spp_pii_encryption): port PII encryption core from openspp-modules

spp_pii_encryption/README.rst

@@ -0,0 +1,162 @@
+======================
+OpenSPP PII Encryption
+======================
+
+..
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:8e2f68c7ce4e6618450ce30c2d60928afe8e918a3f7a91e389a7dd09a0cdf6f5
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Alpha-red.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Alpha
+.. |badge2| image:: https://img.shields.io/badge/license-LGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
+    :alt: License: LGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OpenSPP%2FOpenSPP2-lightgray.png?logo=github
+    :target: https://github.com/OpenSPP/OpenSPP2/tree/19.0/spp_pii_encryption
+    :alt: OpenSPP/OpenSPP2
+
+|badge1| |badge2| |badge3|
+
+Field-level encryption for PII data using AES-256-GCM with searchable
+blind indexes. Provides transparent encryption/decryption through a
+mixin, UI-based configuration of which fields to encrypt, and audit
+logging of PII field access.
+
+Key Capabilities
+~~~~~~~~~~~~~~~~
+
+- Encrypt char/text fields transparently using AES-256-GCM authenticated
+  encryption
+- Search encrypted data via blind indexes without decryption (exact,
+  partial, or phonetic matching)
+- Configure field encryption through UI instead of code changes
+- Audit logging of PII field access events (reveal, export, decrypt,
+  modify, delete) with IP and user agent tracking; logging is invoked by
+  cooperating UI widgets and code paths, it does not intercept every
+  read
+
+Key Models
+~~~~~~~~~~
+
++---------------------------------+------------------------------------+
+| Model                           | Description                        |
++=================================+====================================+
+| ``spp.encrypted.field.mixin``   | Abstract mixin for models with     |
+|                                 | encrypted PII fields               |
++---------------------------------+------------------------------------+
+| ``spp.field.encryption.config`` | UI-based configuration for         |
+|                                 | enabling encryption on specific    |
+|                                 | fields                             |
++---------------------------------+------------------------------------+
+| ``spp.pii.audit.log``           | Audit log of PII field access      |
+|                                 | events                             |
++---------------------------------+------------------------------------+
+
+Configuration
+~~~~~~~~~~~~~
+
+After installing:
+
+1. Navigate to **Key Management > PII Encryption > Field Configuration**
+2. Create a new configuration selecting the model and field to encrypt
+3. Choose the blind index type: Exact (full normalized match), Partial
+   (last 4 characters), or Phonetic (Soundex for names)
+4. Enable encryption and blind index options
+
+Bulk migration of existing plaintext data (scan, dry-run, backup,
+rollback) is provided separately and depends on the data classification
+module.
+
+UI Location
+~~~~~~~~~~~
+
+- **Configuration**: Key Management > PII Encryption > Field
+  Configuration
+- **Audit Log**: Key Management > PII Encryption > Audit Log
+
+Security
+~~~~~~~~
+
++-----------------------------------------------+----------------------------------+
+| Group                                         | Access                           |
++===============================================+==================================+
+| ``spp_pii_encryption.group_encryption_admin`` | Full CRUD on field               |
+|                                               | configuration; Read on audit log |
++-----------------------------------------------+----------------------------------+
+| ``base.group_system``                         | Full CRUD on field               |
+|                                               | configuration; Read/Create on    |
+|                                               | audit logs                       |
++-----------------------------------------------+----------------------------------+
+
+Extension Points
+~~~~~~~~~~~~~~~~
+
+- Inherit from ``spp.encrypted.field.mixin`` on any model with PII
+  fields
+- Implement ``_get_encrypted_fields()`` to specify which fields to
+  encrypt (or configure via UI)
+- Override ``_get_encryption_key(field_name)`` to customize key
+  retrieval per field
+- Override ``_normalize_for_index(value, index_type)`` to customize
+  blind index normalization
+- Use ``_search_by_blind_index(field_name, search_value)`` from
+  server-side code to search encrypted fields (deliberately not
+  RPC-exposed; wrap it with your own access policy)
+- Call ``log_field_access(model, record_id, field, action, reason)`` to
+  audit PII access (the target record must exist and be readable by the
+  caller)
+
+Dependencies
+~~~~~~~~~~~~
+
+``base``, ``spp_key_management``, ``spp_security``
+
+.. IMPORTANT::
+   This is an alpha version, the data model and design can change at any time without warning.
+   Only for development or testing purpose, do not use in production.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OpenSPP/OpenSPP2/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OpenSPP/OpenSPP2/issues/new?body=module:%20spp_pii_encryption%0Aversion:%2019.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* OpenSPP.org
+
+Maintainers
+-----------
+
+.. |maintainer-jeremi| image:: https://github.com/jeremi.png?size=40px
+    :target: https://github.com/jeremi
+    :alt: jeremi
+.. |maintainer-gonzalesedwin1123| image:: https://github.com/gonzalesedwin1123.png?size=40px
+    :target: https://github.com/gonzalesedwin1123
+    :alt: gonzalesedwin1123
+
+Current maintainers:
+
+|maintainer-jeremi| |maintainer-gonzalesedwin1123| 
+
+This module is part of the `OpenSPP/OpenSPP2 <https://github.com/OpenSPP/OpenSPP2/tree/19.0/spp_pii_encryption>`_ project on GitHub.
+
+You are welcome to contribute.

spp_pii_encryption/__init__.py

@@ -0,0 +1,2 @@
+# Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+from . import models

spp_pii_encryption/__manifest__.py

@@ -0,0 +1,42 @@
+# Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+{
+    "name": "OpenSPP PII Encryption",
+    "summary": "Field-level encryption for PII data with searchable blind indexes",
+    "category": "OpenSPP/Configuration",
+    "version": "19.0.1.0.0",
+    "sequence": 1,
+    "author": "OpenSPP.org",
+    "website": "https://github.com/OpenSPP/OpenSPP2",
+    "license": "LGPL-3",
+    "development_status": "Alpha",
+    "maintainers": ["jeremi", "gonzalesedwin1123"],
+    "depends": [
+        "base",
+        "spp_key_management",  # Centralized key management
+        "spp_security",
+    ],
+    "external_dependencies": {
+        "python": [
+            "cryptography",
+        ],
+    },
+    "data": [
+        "security/security_groups.xml",
+        "security/ir.model.access.csv",
+        "views/audit_log_views.xml",
+        "views/field_encryption_config_views.xml",
+        "views/menu.xml",
+    ],
+    "assets": {
+        "web.assets_backend": [
+            "spp_pii_encryption/static/src/js/masked_field.js",
+            "spp_pii_encryption/static/src/xml/masked_field.xml",
+            "spp_pii_encryption/static/src/scss/masked_field.scss",
+        ],
+    },
+    "demo": [],
+    "images": [],
+    "application": False,
+    "installable": True,
+    "auto_install": False,
+}

spp_pii_encryption/models/__init__.py

@@ -0,0 +1,5 @@
+# Part of OpenSPP. See LICENSE file for full copyright and licensing details.
+# Key management is now handled by spp_key_management module
+from . import encrypted_field_mixin
+from . import audit_log
+from . import field_encryption_config