This question has been flagged
3 Replies
59392 Views
projectv7accessrecord_rulesaccess_rules
Avatar
René Schuster

I am currently super confused when handling the permissions for the project module.

At first, some questions:
1. Can Record Rules override Acces Rules?
2. Are Record Rules only used to filter some visible data?
3. Can Record Rules be used to reduce or increase the permissions? or even both? 4. Is there any domain operand to check whether a list conaints an element? (like the opposite of 'in'; e.g. ('member_ids', 'contain', user.id))

What I am trying to do is the following:
My Project module has three groups: User, Accountant, Manager. At the moment, I am only workling on the User group. The project itself has a member list (many2many) and a assigned manager.
I want the permissions this way, that all members of Project/User group can only see (read) the projects in which they are member. Further I want all members of Project/User group, that are manager of a project to be able to read and edit (write) their own projects.

What I have tried that far:
Using an access rule to give the Project/User group read and write access. Creating the following record rules:

<record model="ir.rule" id="project_project_user_rule">
             <field name="name">Project: User is Member</field>
             <field name="model_id" ref="model_project_project"></field>
             <field name="groups" eval="[(4,ref('project.group_project_user'))]"></field>
             <field name="domain_force">[('member_ids', 'in', user.employee_ids[0].id)]</field>
             <field eval="1" name="perm_read"></field>   
             <field eval="0" name="perm_write"></field> 
             <field eval="0" name="perm_unlink"></field>
             <field eval="0" name="perm_create"></field>
     </record>    

     <record model="ir.rule" id="project_project_user_manager_rule">
             <field name="name">Project: User is Manager</field>
             <field name="model_id" ref="model_project_project"></field>
             <field name="groups" eval="[(4,ref('project.group_project_user'))]"></field>
             <field name="domain_force">[('manager_id', '=', user.employee_ids[0].id)]</field>
             <field eval="1" name="perm_write"></field>
             <field eval="1" name="perm_read"></field>
             <field eval="0" name="perm_unlink"></field>
             <field eval="0" name="perm_create"></field>
     </record>

The result is some how mysterious for me.
The project list view shows only the project in which the current user is member or manager (that's what i want!).
Projects in which the user is manager are accessable and editable (that's what i want too!)
Projects in which the user is member are not accessable (Access denied error). (that's not what i want, and confusing, since the record rule domain seems to work in the list view).

EDIT: Gathering more information, I've tried the following domains:

             [('member_ids', '=', user.employee_ids[0].id)]
             [('member_ids.user_id', '=', user.id)]

But for both, the issue remains the same..

Avatar
Discard
Sehrish

ACL in odoo: https://goo.gl/4jAhtH

Avatar
Mind And Go
Best Answer

Hy,

  1. Access rules are per Model access rules and record rules are per Record rules so they can't override the first rule.
  2. I think so
  3. Indirectly it could as you could allow people to see datas that is not natively supposed to be displayed. It's a kind of reduc/increase permission
    1. There is no such an inverse operand but solutions exists check below

Multiple answer for your right access :

  1. For letting the manager read their own project, a simple
    [('user_id','=', user.id)]
    should help because project inherits from account.analytic.account and the project manager is the anlytic one.
  2. For the many2many field Maybe you could try something like this, create another many2many field in the res.users object, call it projects_ids then you'll be able to do something like this :
    [('id','in', [ p.id for p from user.project_ids ])]

Hope it could help

 

 

 

Avatar
Discard
Avatar
Tibor Galko
Best Answer

Hello, In odoo 11 when sending created sale order as email i get error saying that requested operation cannot be completed due to record rules on document Message with operation read. But i don't see this in server logs there is only this: "The requested operation cannot be completed due to record rules: Document type: res.users, Operation: read, Records: 1, User: 27" . I have domain filter for users in place: ['|',('id','=',user.id),('id','=',False)] but removing it does not solve the problem. This error occurs only on some users in same group not all of them. When i transferred whole database to another server i didn't get the error while sending same sale order.

Avatar
Discard