diff --git a/base_group_backend/README.rst b/base_group_backend/README.rst new file mode 100644 index 00000000..a00d2b3b --- /dev/null +++ b/base_group_backend/README.rst @@ -0,0 +1,154 @@ +============= +Group backend +============= + +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:6aed3105c0a4c58cc34c910e88d34a68e14d38a8d549160bbc5b8f276320cda4 + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-LGPL--3-blue.png + :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html + :alt: License: LGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--backend-lightgray.png?logo=github + :target: https://github.com/OCA/server-backend/tree/16.0/base_group_backend + :alt: OCA/server-backend +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/server-backend-16-0/server-backend-16-0-base_group_backend + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png + :target: https://runboat.odoo-community.org/builds?repo=OCA/server-backend&target_branch=16.0 + :alt: Try me on Runboat + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This module was written to extend the standard functionality regarding users +and groups management by adding a new `Backend user` group that only gives access +to odoo backend (`/web`): + +* minimal default access: + * users and partners (this is necessary to access your own data) + * mail activity, notification and channel + * presence +* minimal default menu + * notification + * activities +* minimal default access rules + +The problem with the `Internal user` is when you want to gives access to the +backend to a really thin part of your business to some users, it's quite hard +to properly maintain those roles over the project life, a lot of models use +that group (`base.group_user`) by default which makes hard to maintains. + +So that helps creating well-defined user groups with more controls. + +This modules does 3 things: +* It hijack the has_group method of res.users by returning True for group_backend users when the requested group is group_user (The need for this needs to be investigated) +* It sets the res_users.share to False for group_backend users. This allows those users to access the backend. +* It sets the bare minimum permission in the ir.model.access.csv to display the backend + +We suggest to use this module with its compagnon `base_user_role` + + +Limitations +~~~~~~~~~~~ + +At the time of writing, Odoo uses `res.users.share == False` to give the +backend access. +However to be able to access the backend without any errors some basic rights are necessary. +This module change the way `res.users.share` is computed to allow `group_backend users` to use the backend. + +This avoids to write a lot of overwrite in different controllers from +different modules ('portal', 'web', 'base', 'website') with hard coded statements +that check if user is part of the `base.group_user` or `share == False` group. + +.. warning:: + + Using this module and grant a user with `group_backend`'s group is + equivalent to grant `group_user`'s group everywhere `has_group` + has been used. + +**Table of contents** + +.. contents:: + :local: + +Configuration +============= + +To allow `group_backend` to interact with a model you can either add access rules to the group +or you can add `implied_ids` to `group_backend`. + +.. note:: + + Be aware users can only belong to one group from the user type category + (`base.module_category_user_type`). So your other groups can't inherit both + internal users and backend users. + +Usage +===== + +To use this module, you need to: + +#. Go to Configuration / Users / Users, choose a user and set the user type. + +You get a users that is only able to access to the Odoo backend which you +can attach other groups that not implies other kind of users (`portal`, +`internal users`) + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +~~~~~~~ + +* Pierre Verkest + +Contributors +~~~~~~~~~~~~ + +* Pierre Verkest +* François Poizat + +Do not contact contributors directly about support or help with technical issues. + +Maintainers +~~~~~~~~~~~ + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +.. |maintainer-oca| image:: https://github.com/oca.png?size=40px + :target: https://github.com/oca + :alt: oca + +Current `maintainer `__: + +|maintainer-oca| + +This module is part of the `OCA/server-backend `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/base_group_backend/__init__.py b/base_group_backend/__init__.py new file mode 100644 index 00000000..fc95f8e7 --- /dev/null +++ b/base_group_backend/__init__.py @@ -0,0 +1,2 @@ +from . import models +from . import demo diff --git a/base_group_backend/__manifest__.py b/base_group_backend/__manifest__.py new file mode 100644 index 00000000..26b4c584 --- /dev/null +++ b/base_group_backend/__manifest__.py @@ -0,0 +1,23 @@ +# Copyright 2021 Pierre Verkest +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html). +{ + "name": "Group backend", + "version": "16.0.1.0.0", + "category": "Tools", + "author": "Pierre Verkest, Odoo Community Association (OCA)", + "license": "LGPL-3", + "maintainers": ["oca"], + "website": "https://github.com/OCA/server-backend", + "depends": ["base", "mail"], + "demo": [ + "demo/test-model.xml", + "demo/ir.model.access.csv", + "demo/backend_dummy_model.xml", + ], + "data": [ + "data/res-groups.xml", + "security/ir.model.access.csv", + ], + "installable": True, + "application": True +} diff --git a/base_group_backend/data/res-groups.xml b/base_group_backend/data/res-groups.xml new file mode 100644 index 00000000..eb3291e9 --- /dev/null +++ b/base_group_backend/data/res-groups.xml @@ -0,0 +1,18 @@ + + + Backend user + + + This group is used to gives user backend access. + + While users in `base.group_user` gets a lot of default access + which makes hard to define properly records/rules/menu access. + + So for maintainability you shouldn't linked any access right, rules, + menu, and so on to this group directly. + + The only intent of this groups is to be able to get a session + to Odoo backend (`/web`). + + + diff --git a/base_group_backend/demo/__init__.py b/base_group_backend/demo/__init__.py new file mode 100644 index 00000000..0c180055 --- /dev/null +++ b/base_group_backend/demo/__init__.py @@ -0,0 +1,5 @@ +from odoo.tools import config + +if not config['without_demo']: + from . import backend_dummy_model + diff --git a/base_group_backend/demo/backend_dummy_model.py b/base_group_backend/demo/backend_dummy_model.py new file mode 100644 index 00000000..49fd4b12 --- /dev/null +++ b/base_group_backend/demo/backend_dummy_model.py @@ -0,0 +1,11 @@ +from odoo import fields, models + +class BackendDummyModel(models.Model): + _name = "backend.dummy.model" + _inherit = ["mail.activity.mixin"] + _description = 'Nothing to see here' + + my_value = fields.Char(name="Value", required=True) + my_other_value = fields.Char(name="Other value", required=True) + date_start = fields.Datetime(name="Date start", required=True, default=fields.Datetime.now) + date_stop = fields.Datetime(name="Date stop", required=True, default=fields.Datetime.now) diff --git a/base_group_backend/demo/backend_dummy_model.xml b/base_group_backend/demo/backend_dummy_model.xml new file mode 100644 index 00000000..927f9bca --- /dev/null +++ b/base_group_backend/demo/backend_dummy_model.xml @@ -0,0 +1,43 @@ + + + + + Backend dummy tree view + backend.dummy.model + + + + + + + + + Dummies + ir.actions.act_window + backend.dummy.model + tree,form,kanban,calendar,pivot,graph,activity + + + + + + + diff --git a/base_group_backend/demo/ir.model.access.csv b/base_group_backend/demo/ir.model.access.csv new file mode 100644 index 00000000..fb5cf586 --- /dev/null +++ b/base_group_backend/demo/ir.model.access.csv @@ -0,0 +1,3 @@ +"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink" +"access_backend_dummy_models","backend_dummy_model all","base_group_backend.model_backend_dummy_model",group_backend,1,0,0,0 +"access_backend_dummy_models_all","backend_dummy_model all","base_group_backend.model_backend_dummy_model",base.group_user,1,0,0,0 diff --git a/base_group_backend/demo/test-model.xml b/base_group_backend/demo/test-model.xml new file mode 100644 index 00000000..70db2080 --- /dev/null +++ b/base_group_backend/demo/test-model.xml @@ -0,0 +1,8 @@ + + + + hello + hello + + + diff --git a/base_group_backend/models/__init__.py b/base_group_backend/models/__init__.py new file mode 100644 index 00000000..beafab2f --- /dev/null +++ b/base_group_backend/models/__init__.py @@ -0,0 +1,2 @@ +from odoo.tools import config +from . import res_users diff --git a/base_group_backend/models/res_users.py b/base_group_backend/models/res_users.py new file mode 100644 index 00000000..51c51b8f --- /dev/null +++ b/base_group_backend/models/res_users.py @@ -0,0 +1,42 @@ +import logging + +from odoo import api, models + +_logger = logging.getLogger(__name__) + + +class Users(models.Model): + _inherit = "res.users" + + + # TODO: (franz) make it clear why we test with "." group and why the share = True + @api.model + def has_group(self, group_ext_id): + """While ensuring a user is part of `base.group_user` this code will + try if user is in the `base_group_backend.group_backend` group to let access + to the odoo backend. + + This code avoid to overwrite a lot of places in controllers from + different modules ('portal', 'web', 'base') with hardcoded statement + that check if user is part of `base.group_user` group. + + As far `base.group_user` have a lot of default permission this + makes hard to maintain proper access right according your business. + """ + res = super().has_group(group_ext_id) + if not res and (group_ext_id == "base.group_user"): + has_base_group_backend = super().has_group( + "base_group_backend.group_backend" + ) + if has_base_group_backend: + _logger.warning("Forcing has_group to return True for group_backend") + return has_base_group_backend + return res + + @api.depends('groups_id') + def _compute_share(self): + user_group_id = self.env['ir.model.data']._xmlid_to_res_id('base.group_user') + backend_user_group_id = self.env['ir.model.data']._xmlid_to_res_id('base_group_backend.group_backend') + internal_users = self.filtered_domain([('groups_id', 'in', [user_group_id, backend_user_group_id])]) + internal_users.share = False + (self - internal_users).share = True diff --git a/base_group_backend/readme/CONFIGURE.rst b/base_group_backend/readme/CONFIGURE.rst new file mode 100644 index 00000000..e480b4f2 --- /dev/null +++ b/base_group_backend/readme/CONFIGURE.rst @@ -0,0 +1,8 @@ +To allow `group_backend` to interact with a model you can either add access rules to the group +or you can add `implied_ids` to `group_backend`. + +.. note:: + + Be aware users can only belong to one group from the user type category + (`base.module_category_user_type`). So your other groups can't inherit both + internal users and backend users. diff --git a/base_group_backend/readme/CONTRIBUTORS.rst b/base_group_backend/readme/CONTRIBUTORS.rst new file mode 100644 index 00000000..f8032a3b --- /dev/null +++ b/base_group_backend/readme/CONTRIBUTORS.rst @@ -0,0 +1,4 @@ +* Pierre Verkest +* François Poizat + +Do not contact contributors directly about support or help with technical issues. diff --git a/base_group_backend/readme/DESCRIPTION.rst b/base_group_backend/readme/DESCRIPTION.rst new file mode 100644 index 00000000..c640e2e5 --- /dev/null +++ b/base_group_backend/readme/DESCRIPTION.rst @@ -0,0 +1,45 @@ +This module was written to extend the standard functionality regarding users +and groups management by adding a new `Backend user` group that only gives access +to odoo backend (`/web`): + +* minimal default access: + * users and partners (this is necessary to access your own data) + * mail activity, notification and channel + * presence +* minimal default menu + * notification + * activities +* minimal default access rules + +The problem with the `Internal user` is when you want to gives access to the +backend to a really thin part of your business to some users, it's quite hard +to properly maintain those roles over the project life, a lot of models use +that group (`base.group_user`) by default which makes hard to maintains. + +So that helps creating well-defined user groups with more controls. + +This modules does 3 things: +* It hijack the has_group method of res.users by returning True for group_backend users when the requested group is group_user (The need for this needs to be investigated) +* It sets the res_users.share to False for group_backend users. This allows those users to access the backend. +* It sets the bare minimum permission in the ir.model.access.csv to display the backend + +We suggest to use this module with its compagnon `base_user_role` + + +Limitations +~~~~~~~~~~~ + +At the time of writing, Odoo uses `res.users.share == False` to give the +backend access. +However to be able to access the backend without any errors some basic rights are necessary. +This module change the way `res.users.share` is computed to allow `group_backend users` to use the backend. + +This avoids to write a lot of overwrite in different controllers from +different modules ('portal', 'web', 'base', 'website') with hard coded statements +that check if user is part of the `base.group_user` or `share == False` group. + +.. warning:: + + Using this module and grant a user with `group_backend`'s group is + equivalent to grant `group_user`'s group everywhere `has_group` + has been used. diff --git a/base_group_backend/readme/USAGE.rst b/base_group_backend/readme/USAGE.rst new file mode 100644 index 00000000..b921656c --- /dev/null +++ b/base_group_backend/readme/USAGE.rst @@ -0,0 +1,7 @@ +To use this module, you need to: + +#. Go to Configuration / Users / Users, choose a user and set the user type. + +You get a users that is only able to access to the Odoo backend which you +can attach other groups that not implies other kind of users (`portal`, +`internal users`) diff --git a/base_group_backend/security/ir.model.access.csv b/base_group_backend/security/ir.model.access.csv new file mode 100644 index 00000000..26e0c9f0 --- /dev/null +++ b/base_group_backend/security/ir.model.access.csv @@ -0,0 +1,13 @@ +id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink +access_res_users_all,res_users all,model_res_users,group_backend,1,0,0,0 +access_res_partners_all,res_partners all,base.model_res_partner,group_backend,1,0,0,0 +access_ir_ui_menu_group_user,ir_ui_menu group_user,base.model_ir_ui_menu,group_backend,1,0,0,0 +access_ir_filter_user,ir_filters all,base.model_ir_filters,group_backend,1,1,1,1 +access_bus_presence,bus.presence,bus.model_bus_presence,group_backend,1,1,1,1 +access_mail_channel_member_user,mail.channel.member.user,mail.model_mail_channel_member,group_backend,1,1,1,0 +access_mail_channel_user,mail.group.user,mail.model_mail_channel,group_backend,1,1,1,0 +access_mail_notification_user,mail.notification.user,mail.model_mail_notification,group_backend,1,1,1,0 +access_mail_activity_user,mail.activity.user,mail.model_mail_activity,group_backend,1,1,1,1 +access_mail_activity_type_user,mail.activity.type.user,mail.model_mail_activity_type,group_backend,1,0,0,0 +access_ir_attachment_group_user,ir_attachment group_user,base.model_ir_attachment,group_backend,1,0,0,0 +access_mail_followers_user,mail.followers.user,mail.model_mail_followers,group_backend,1,0,0,0 diff --git a/base_group_backend/static/description/index.html b/base_group_backend/static/description/index.html new file mode 100644 index 00000000..34383a76 --- /dev/null +++ b/base_group_backend/static/description/index.html @@ -0,0 +1,481 @@ + + + + + + +Group backend + + + +
+

Group backend

+ + +

Beta License: LGPL-3 OCA/server-backend Translate me on Weblate Try me on Runboat

+

This module was written to extend the standard functionality regarding users +and groups management by adding a new Backend user group that only gives access +to odoo backend (/web):

+
    +
  • minimal default access: +* users and partners (this is necessary to access your own data) +* mail activity, notification and channel +* presence
    • +
  • minimal default menu +* notification +* activities
    • +
  • minimal default access rules
    • +
+

The problem with the Internal user is when you want to gives access to the +backend to a really thin part of your business to some users, it’s quite hard +to properly maintain those roles over the project life, a lot of models use +that group (base.group_user) by default which makes hard to maintains.

+

So that helps creating well-defined user groups with more controls.

+

This modules does 3 things: +* It hijack the has_group method of res.users by returning True for group_backend users when the requested group is group_user (The need for this needs to be investigated) +* It sets the res_users.share to False for group_backend users. This allows those users to access the backend. +* It sets the bare minimum permission in the ir.model.access.csv to display the backend

+

We suggest to use this module with its compagnon base_user_role

+
+

Limitations

+

At the time of writing, Odoo uses res.users.share == False to give the +backend access. +However to be able to access the backend without any errors some basic rights are necessary. +This module change the way res.users.share is computed to allow group_backend users to use the backend.

+

This avoids to write a lot of overwrite in different controllers from +different modules (‘portal’, ‘web’, ‘base’, ‘website’) with hard coded statements +that check if user is part of the base.group_user or share == False group.

+
+

Warning

+

Using this module and grant a user with group_backend’s group is +equivalent to grant group_user’s group everywhere has_group +has been used.

+
+

Table of contents

+ +
+

Configuration

+

To allow group_backend to interact with a model you can either add access rules to the group +or you can add implied_ids to group_backend.

+
+

Note

+

Be aware users can only belong to one group from the user type category +(base.module_category_user_type). So your other groups can’t inherit both +internal users and backend users.

+
+
+
+

Usage

+

To use this module, you need to:

+
    +
  1. Go to Configuration / Users / Users, choose a user and set the user type.
    2. +
+

You get a users that is only able to access to the Odoo backend which you +can attach other groups that not implies other kind of users (portal, +internal users)

+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+ +
+
+

Authors

+
    +
  • Pierre Verkest
    • +
+
+
+

Contributors

+ +

Do not contact contributors directly about support or help with technical issues.

+
+
+

Maintainers

+

This module is maintained by the OCA.

+Odoo Community Association +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

Current maintainer:

+

oca

+

This module is part of the OCA/server-backend project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+ + diff --git a/base_group_backend/tests/__init__.py b/base_group_backend/tests/__init__.py new file mode 100644 index 00000000..d9b96c4f --- /dev/null +++ b/base_group_backend/tests/__init__.py @@ -0,0 +1 @@ +from . import test_module diff --git a/base_group_backend/tests/test_module.py b/base_group_backend/tests/test_module.py new file mode 100644 index 00000000..a674b244 --- /dev/null +++ b/base_group_backend/tests/test_module.py @@ -0,0 +1,19 @@ +from odoo import Command +from odoo.tests.common import TransactionCase + + +class TestResUsers(TransactionCase): + @classmethod + def setUpClass(cls): + super().setUpClass() + cls.base_group_backend = cls.env.ref("base_group_backend.group_backend") + cls.internal_user = cls.env.ref("base.user_demo") + cls.portal_user = cls.env.ref("base.demo_user0") + + def test_has_groups(self): + self.assertFalse(self.portal_user.has_group("base.group_user")) + self.assertTrue(self.internal_user.has_group("base.group_user")) + self.portal_user.write( + {"groups_id": [Command.set([self.base_group_backend.id])]} + ) + self.assertTrue(self.portal_user.has_group("base.group_user")) diff --git a/setup/base_group_backend/odoo/addons/base_group_backend b/setup/base_group_backend/odoo/addons/base_group_backend new file mode 120000 index 00000000..99760248 --- /dev/null +++ b/setup/base_group_backend/odoo/addons/base_group_backend @@ -0,0 +1 @@ +../../../../base_group_backend \ No newline at end of file diff --git a/setup/base_group_backend/setup.py b/setup/base_group_backend/setup.py new file mode 100644 index 00000000..28c57bb6 --- /dev/null +++ b/setup/base_group_backend/setup.py @@ -0,0 +1,6 @@ +import setuptools + +setuptools.setup( + setup_requires=['setuptools-odoo'], + odoo_addon=True, +)