Skip to Content
เมนู
คุณต้องลงทะเบียนเพื่อโต้ตอบกับคอมมูนิตี้
คำถามนี้ถูกตั้งค่าสถานะ
2 ตอบกลับ
7101 มุมมอง

I need to define ir.rule that limits the permissions read, create, write, unlink based on state for a specific security group. If I understand correctly the domain_force filters the records.


<record id="tabla_sp_access_rule" model="ir.rule">
	<field name="name">Access ule</field>
	<field name="model_id" ref="tabla_price.tabla_price_group"/>
	<field name="domain_force">[('create_uid','=',user.id)]</field>
	<field name="groups" eval="[(4, ref('tabla_price.tabla_price_group'))]"/>
</record>
<record id="tabla_sp_state_rule" model="ir.rule">
	<field name="name">States rule</field>
	<field name="model_id" ref="tabla_price.tabla_price"/>
	<field name="domain_force">[('state','in', ['done', 'confirmed', 'canceled'])]</field>
	<field name="groups" eval="[(4, ref('tabla_price.tabla_price_group'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>

Because of the domain force now only the records that are from the user and in states will be shown to the user. I need to show user his records and only prevent write and unlink permissions on state.


I cannot just set fields readonly based on states, because different user groups can do different things based on state.


What is the correct way to do this? Can I do this with ir.rules and I just don't undestand domain_force parameter? 

EDIT:

I've got 3 groups: Importer <- Validator <- Admin.

Importer can CRUD only his own records when the state is "draft", other states he can only Read them.

Validator can Read all records but he can only Update them when they are in state "update".

Admin can see all records and use CRUDE for states "draft", "update" and "cancel".

All have model rights 1,1,1,1.

Importer
<record id="tabla_sp_importer_access_rule" model="ir.rule">
	<field name="name">Importer Access Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">['|', ('create_uid','=',user.id), ('partner_id', '=', user.partner_id.id)]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_importer'))]"/>
</record>

<record id="tabla_sp_importer_state_rule" model="ir.rule">
	<field name="name">Importer States Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[('state','in', ['done', 'canceled'])]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_importer'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>


Validator
<record id="tabla_sp_validator_access_rule" model="ir.rule">
	<field name="name">Validator Access Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[(1, '=', 1)]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_validator'))]"/>
</record>

<record id="tabla_sp_validator_state_rule" model="ir.rule">
	<field name="name">Validator States Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[('state','in', ['draft', 'done', 'canceled'])]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_validator'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>

Admin
<record id="admin_state_rule" model="ir.rule">
	<field name="name">Administrator States Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[('state','=', 'done')]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_admin'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>







 


อวตาร
ละทิ้ง
คำตอบที่ดีที่สุด

See this example in expense:

<record id="sale_order_rule_expense_user" model="ir.rule">
<field name="name">Expense Employee can read confirmed SO</field>
<field ref="sale.model_sale_order" name="model_id"/>
<field name="domain_force">[('state', '=', 'sale')]</field>
<field name="groups" eval="[(4, ref('base.group_user'))]"/>
<field name="perm_read" eval="True"/>
<field name="perm_write" eval="False"/>
<field name="perm_create" eval="False"/>
<field name="perm_unlink" eval="False"/>
</record>
อวตาร
ละทิ้ง
ผู้เขียน

Thanks... I looked at them, but I'm still having hard time to figure them out. The problem is that I have 3 different user groups that need to have different rights. Will update my question

คำตอบที่ดีที่สุด

Yes you can set specific rule for each group,

You have to define the group in  <field name="groups" eval="[(4, ref('base.group_user'))]"/>

อวตาร
ละทิ้ง
Related Posts ตอบกลับ มุมมอง กิจกรรม
1
มี.ค. 15
7580
1
พ.ค. 18
15672
1
ก.ค. 15
4163
1
ส.ค. 24
1630
0
มิ.ย. 22
2261