first push message

custom_subscriptions/controllers/main.py

@@ -0,0 +1,31 @@
+from odoo import http
+from odoo.http import request
+
+class AppSelectorController(http.Controller):
+
+    @http.route('/custom_subscriptions/get_available_apps', type='json', auth='user', methods=['POST'])
+    def get_available_apps(self):
+        """
+        Securely fetches uninstalled apps for the selector.
+        auth='user' ensures only logged-in users can access.
+        """
+        # Security: Use sudo() to read module data, but filter safely
+        modules = request.env['ir.module.module'].sudo().search([
+            ('state', '=', 'uninstalled'),
+            ('application', '=', True),
+            ('name', 'not in', ['web', 'base', 'custom_subscriptions', 'mail']),
+        ], order='name')
+
+        categories = {}
+        for mod in modules:
+            cat = mod.category_id.name or 'Other'
+            if cat not in categories:
+                categories[cat] = []
+            categories[cat].append({
+                'id': mod.id,
+                'name': mod.name,
+                'shortdesc': mod.shortdesc or '',
+                'icon': mod.icon_image and f'/web/image/ir.module.module/{mod.id}/icon_image' or '/web/static/img/placeholder.png',
+            })
+
+        return categories