[18.0][FIX] web_m2x_options: allow field-level overrides of the global create and create_edit options

[Ricardoalso]

Allow field-level overrides for Many2One and Many2Many fields, while always respecting security permissions. This provides more granular control over the "Create..." and "Create and Edit..." dropdown entries without compromising access control.

The web_m2x_options module provides global ir.config_parameter options to control "Create..." and "Create and Edit..." entries for all widgets in the Odoo instance:

• web_m2x_options.create - Controls "Create..." entry globally
• web_m2x_options.create_edit - Controls "Create and Edit..." entry globally

Previously, there was no way to selectively enable these options for specific fields when globally disabled, or to disable them for specific fields when globally enabled.

---

⚠️
Without using web_m2x_options_manager, this error likely wouldn’t occur (although I haven’t tested every edge case).
Functionally tested coupled with https://github.com/OCA/web/tree/18.0/web_m2x_options_manager

[leemannd]

@SilvioC2C you may be interested

[gurneyalex]

@Ricardoalso Maybe you should update the documentation of the addon to explain how the new features are used.

[SilvioC2C]

LGTM, thanks!

Agree w/ @gurneyalex about updating the docs though

[OCA-git-bot]

This PR has the approved label and has been created more than 5 days ago. It should therefore be ready to merge by a maintainer (or a PSC member if the concerned addon has no declared maintainer). 🤖

[Ricardoalso]

@SilvioC2C @gurneyalex Thanks for the reviews

This issue is actually related to a FIX in the web_m2x_options module, which serves as the foundation for the web_m2x_options_manager module.
Without using web_m2x_options_manager, this error likely wouldn’t occur (although I haven’t tested every edge case).

The documentation for web_m2x_options_manager seems quite explicit to me 🤔

Also, my PR description might have been unclear — I’ve now added some extra details to clarify things.

[alexey-pelykh]

Thanks @Ricardoalso, clean fix.

The extracted helpers (evaluateHasCreatePermission, evaluateFieldBooleanOption) are a nice DRY improvement, and the new "create" in options / "create_edit" in options branches slot neatly into the existing priority cascade. Security permission is always ANDed in, so field-level overrides can never bypass access control -- good.

Reviewed the symmetry across all four methods (m2o + m2m, create + create_edit) and the edge cases (explicit deny via no_quick_create still wins). LGTM.

[tarteo]

/ocabot merge patch

[OCA-git-bot]

Hey, thanks for contributing! Proceeding to merge this for you.
Prepared branch 18.0-ocabot-merge-pr-3400-by-tarteo-bump-patch, awaiting test results.

[OCA-git-bot]

Congratulations, your PR was merged at 8f675ca. Thanks a lot for contributing to OCA. ❤️