Chapter 4: Security - A Brief Introduction¶
In the previous chapter, we created our first table intended to store business data. In a business application such as Odoo, one of the first questions to consider is who1 can access the data. Odoo provides a security mechanism to allow access to the data for specific groups of users.
The topic of security is covered in more detail in Restrict access to data. This chapter aims to cover the minimum required for our new module.
Data Files (CSV)¶
Odoo is a highly data driven system. Although behavior is customized using Python code, part of a
module’s value is in the data it sets up when loaded. One way to load data is through a CSV
file. One example is the list of country states which is loaded at installation of the
base module.
"id","country_id:id","name","code"
state_au_1,au,"Australian Capital Territory","ACT"
state_au_2,au,"New South Wales","NSW"
state_au_3,au,"Northern Territory","NT"
state_au_4,au,"Queensland","QLD"
...
idis an external identifier. It can be used to refer to the record (without knowing its in-database identifier).country_id:idrefers to the country by using its external identifier.nameis the name of the state.codeis the code of the state.
These three fields are
defined
in the res.country.state model.
By convention, a file importing data is located in the data folder of a module. When the data
is related to security, it is located in the security folder. When the data is related to
views and actions (we will cover this later), it is located in the views folder.
Additionally, all of these files must be declared in the data
list within the __manifest__.py file. Our example file is defined
in the manifest of the base module.
Also note that the content of the data files is only loaded when a module is installed or updated.
Avvertimento
The data files are sequentially loaded following their order in the __manifest__.py file.
This means that if data A refers to data B, you must make sure that B
is loaded before A.
In the case of the country states, you will note that the list of countries is loaded before the list of country states. This is because the states refer to the countries.
Why is all this important for security? Because all the security configuration of a model is loaded through data files, as we’ll see in the next section.
Access Rights¶
Reference: the documentation related to this topic can be found in Access Rights.
When no access rights are defined on a model, Odoo determines that no users can access the data.
Access rights are defined as records of the model ir.access. Each access
right is associated with a model, a group (or no group for restrictions), a set
of operations (a subset of create, read, update and delete2) and an
optional domain.
Such access rights are usually defined in a CSV file named ir.access.csv.
Here is an example for our previous test_model:
id,name,model_id,group_id/id,operation,domain
access_test_model,access_test_model,test_model,base.group_user,crud,
idis an external identifier.nameis the description of their.access.model_idrefers to the model which the access right applies to. The standard way to refer to the model is the_nameof the model.group_id/idrefers to the group which the access right applies to.operation: specifies which operations on the model the access refers to (create, read, update, delete). For instance, the stringrurefers to the set {read, update}.domain: permits or restricts the access to the records that satisfy the domain. If a group is given, the record provides permission to the users of the given group. Otherwise, the record restricts access to the users that satisfy the domain for all users.
Exercise
Add access rights.
Create the ir.access.csv file in the appropriate folder and define it in the
__manifest__.py file.
Give the create, read, update and delete permissions to the group base.group_user.
It’s now time to finally interact with the UI!