diff --git a/operating_unit_window_action_isolation/README.rst b/operating_unit_window_action_isolation/README.rst new file mode 100644 index 0000000000..6febd7c49c --- /dev/null +++ b/operating_unit_window_action_isolation/README.rst @@ -0,0 +1,130 @@ +====================================== +Operating Unit Window Action Isolation +====================================== + +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:30504a1a9af9d8b728d4f79e1ec6971b08bc717e426e975d265cb4f2b8963db9 + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Foperating--unit-lightgray.png?logo=github + :target: https://github.com/OCA/operating-unit/tree/18.0/operating_unit_window_action_isolation + :alt: OCA/operating-unit +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/operating-unit-18-0/operating-unit-18-0-operating_unit_window_action_isolation + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png + :target: https://runboat.odoo-community.org/builds?repo=OCA/operating-unit&target_branch=18.0 + :alt: Try me on Runboat + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This module extends Odoo window actions to automatically restrict +records according to the user's default operating unit. + +When a user opens a menu linked to an ``ir.actions.act_window``, an +additional domain is injected when: + +- The user is not the superuser. +- The user has a default operating unit configured. +- The target model contains an ``operating_unit_id`` field. + +The injected domain allows access to: + +- Records belonging to the user's default operating unit. +- Records without an operating unit assigned. + +**Table of contents** + +.. contents:: + :local: + +Usage +===== + +Configure operating units and assign a default operating unit to users. + +Example: + +- User A → Default Operating Unit = OU-A +- User B → Default Operating Unit = OU-B + +When a window action targets a model containing an ``operating_unit_id`` +field, the action domain is automatically extended. + +For User A: + +.. code:: python + + [('operating_unit_id', 'in', [False, OU_A_ID])] + +For User B: + +.. code:: python + + [('operating_unit_id', 'in', [False, OU_B_ID])] + +As a result: + +- User A sees records belonging to OU-A and records without an operating + unit. +- User B sees records belonging to OU-B and records without an operating + unit. +- Users without a default operating unit are not affected. +- The superuser is not affected. + +Known issues / Roadmap +====================== + +- No known issues. + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +------- + +* CIT Services + +Contributors +------------ + +- `CIT Services `__ + + - Manfred Nelvin + +Maintainers +----------- + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +This module is part of the `OCA/operating-unit `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/operating_unit_window_action_isolation/__init__.py b/operating_unit_window_action_isolation/__init__.py new file mode 100644 index 0000000000..2371615848 --- /dev/null +++ b/operating_unit_window_action_isolation/__init__.py @@ -0,0 +1,4 @@ +# Copyright (C) 2016-2027 CIT Services +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import models diff --git a/operating_unit_window_action_isolation/__manifest__.py b/operating_unit_window_action_isolation/__manifest__.py new file mode 100644 index 0000000000..47796ffc97 --- /dev/null +++ b/operating_unit_window_action_isolation/__manifest__.py @@ -0,0 +1,20 @@ +# Copyright (C) 2016-2027 CIT Services +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +{ + "name": "Operating Unit Window Action Isolation", + "summary": "Restrict window action records by operating unit", + "version": "18.0.1.0.0", + "category": "Generic Modules", + "author": "CIT Services, Odoo Community Association (OCA)", + "company": "CIT Services", + "website": "https://github.com/OCA/operating-unit", + "license": "AGPL-3", + "depends": [ + "operating_unit", + "sale_operating_unit", + ], + "data": [], + "installable": True, + "application": False, +} diff --git a/operating_unit_window_action_isolation/models/__init__.py b/operating_unit_window_action_isolation/models/__init__.py new file mode 100644 index 0000000000..1a2e98a8c6 --- /dev/null +++ b/operating_unit_window_action_isolation/models/__init__.py @@ -0,0 +1,4 @@ +# Copyright (C) 2016-2027 CIT Services +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import ir_actions_act_window diff --git a/operating_unit_window_action_isolation/models/ir_actions_act_window.py b/operating_unit_window_action_isolation/models/ir_actions_act_window.py new file mode 100644 index 0000000000..59b8fcfbb5 --- /dev/null +++ b/operating_unit_window_action_isolation/models/ir_actions_act_window.py @@ -0,0 +1,44 @@ +# Copyright (C) 2016-2027 CIT Services +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from odoo import models +from odoo.osv import expression +from odoo.tools.safe_eval import safe_eval + + +class IrActionsActWindow(models.Model): + _inherit = "ir.actions.act_window" + + def read(self, fields=None, load="_classic_read"): + """Restrict actions to the user's default operating unit.""" + result = super().read(fields=fields, load=load) + + if self.env.is_superuser(): + return result + + user_ou = self.env.user.default_operating_unit_id + if not user_ou: + return result + + for action in result: + res_model = action.get("res_model") + + if ( + not res_model + or res_model not in self.env + or "operating_unit_id" not in self.env[res_model]._fields + ): + continue + + ou_domain = [("operating_unit_id", "in", [False, user_ou.id])] + + domain = [] + if action.get("domain"): + try: + domain = safe_eval(action["domain"]) + except (ValueError, SyntaxError, TypeError): + continue + + action["domain"] = expression.AND([domain, ou_domain]) + + return result diff --git a/operating_unit_window_action_isolation/pyproject.toml b/operating_unit_window_action_isolation/pyproject.toml new file mode 100644 index 0000000000..4231d0cccb --- /dev/null +++ b/operating_unit_window_action_isolation/pyproject.toml @@ -0,0 +1,3 @@ +[build-system] +requires = ["whool"] +build-backend = "whool.buildapi" diff --git a/operating_unit_window_action_isolation/readme/CONTRIBUTORS.md b/operating_unit_window_action_isolation/readme/CONTRIBUTORS.md new file mode 100644 index 0000000000..5c9e328ba5 --- /dev/null +++ b/operating_unit_window_action_isolation/readme/CONTRIBUTORS.md @@ -0,0 +1,2 @@ +- [CIT Services](https://cit-services.eu/) + - Manfred Nelvin \ \ No newline at end of file diff --git a/operating_unit_window_action_isolation/readme/DESCRIPTION.md b/operating_unit_window_action_isolation/readme/DESCRIPTION.md new file mode 100644 index 0000000000..2b4824ea84 --- /dev/null +++ b/operating_unit_window_action_isolation/readme/DESCRIPTION.md @@ -0,0 +1,14 @@ +This module extends Odoo window actions to automatically restrict +records according to the user's default operating unit. + +When a user opens a menu linked to an `ir.actions.act_window`, an +additional domain is injected when: + +- The user is not the superuser. +- The user has a default operating unit configured. +- The target model contains an `operating_unit_id` field. + +The injected domain allows access to: + +- Records belonging to the user's default operating unit. +- Records without an operating unit assigned. \ No newline at end of file diff --git a/operating_unit_window_action_isolation/readme/ROADMAP.md b/operating_unit_window_action_isolation/readme/ROADMAP.md new file mode 100644 index 0000000000..f49fbf8fe9 --- /dev/null +++ b/operating_unit_window_action_isolation/readme/ROADMAP.md @@ -0,0 +1 @@ +- No known issues. \ No newline at end of file diff --git a/operating_unit_window_action_isolation/readme/USAGE.md b/operating_unit_window_action_isolation/readme/USAGE.md new file mode 100644 index 0000000000..cfb6955963 --- /dev/null +++ b/operating_unit_window_action_isolation/readme/USAGE.md @@ -0,0 +1,27 @@ +Configure operating units and assign a default operating unit to users. + +Example: + +- User A → Default Operating Unit = OU-A +- User B → Default Operating Unit = OU-B + +When a window action targets a model containing an `operating_unit_id` field, the action domain is automatically extended. + +For User A: + +```python +[('operating_unit_id', 'in', [False, OU_A_ID])] +``` + +For User B: + +```python +[('operating_unit_id', 'in', [False, OU_B_ID])] +``` + +As a result: + +- User A sees records belonging to OU-A and records without an operating unit. +- User B sees records belonging to OU-B and records without an operating unit. +- Users without a default operating unit are not affected. +- The superuser is not affected. \ No newline at end of file diff --git a/operating_unit_window_action_isolation/static/description/icon.png b/operating_unit_window_action_isolation/static/description/icon.png new file mode 100644 index 0000000000..3a0328b516 Binary files /dev/null and b/operating_unit_window_action_isolation/static/description/icon.png differ diff --git a/operating_unit_window_action_isolation/static/description/index.html b/operating_unit_window_action_isolation/static/description/index.html new file mode 100644 index 0000000000..f0abf3ac06 --- /dev/null +++ b/operating_unit_window_action_isolation/static/description/index.html @@ -0,0 +1,475 @@ + + + + + +Operating Unit Window Action Isolation + + + +
+

Operating Unit Window Action Isolation

+ + +

Beta License: AGPL-3 OCA/operating-unit Translate me on Weblate Try me on Runboat

+

This module extends Odoo window actions to automatically restrict +records according to the user’s default operating unit.

+

When a user opens a menu linked to an ir.actions.act_window, an +additional domain is injected when:

+
    +
  • The user is not the superuser.
    • +
  • The user has a default operating unit configured.
    • +
  • The target model contains an operating_unit_id field.
    • +
+

The injected domain allows access to:

+
    +
  • Records belonging to the user’s default operating unit.
    • +
  • Records without an operating unit assigned.
    • +
+

Table of contents

+ +
+

Usage

+

Configure operating units and assign a default operating unit to users.

+

Example:

+
    +
  • User A → Default Operating Unit = OU-A
    • +
  • User B → Default Operating Unit = OU-B
    • +
+

When a window action targets a model containing an operating_unit_id +field, the action domain is automatically extended.

+

For User A:

+
+[('operating_unit_id', 'in', [False, OU_A_ID])]
+
+

For User B:

+
+[('operating_unit_id', 'in', [False, OU_B_ID])]
+
+

As a result:

+
    +
  • User A sees records belonging to OU-A and records without an operating +unit.
    • +
  • User B sees records belonging to OU-B and records without an operating +unit.
    • +
  • Users without a default operating unit are not affected.
    • +
  • The superuser is not affected.
    • +
+
+
+

Known issues / Roadmap

+
    +
  • No known issues.
    • +
+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • CIT Services
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is maintained by the OCA.

+ +Odoo Community Association + +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

This module is part of the OCA/operating-unit project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+ + diff --git a/operating_unit_window_action_isolation/tests/__init__.py b/operating_unit_window_action_isolation/tests/__init__.py new file mode 100644 index 0000000000..1c2e9a386a --- /dev/null +++ b/operating_unit_window_action_isolation/tests/__init__.py @@ -0,0 +1,4 @@ +# Copyright (C) 2016-2027 CIT Services +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import test_ir_actions_act_window diff --git a/operating_unit_window_action_isolation/tests/test_ir_actions_act_window.py b/operating_unit_window_action_isolation/tests/test_ir_actions_act_window.py new file mode 100644 index 0000000000..129271309c --- /dev/null +++ b/operating_unit_window_action_isolation/tests/test_ir_actions_act_window.py @@ -0,0 +1,205 @@ +# Copyright (C) 2016-2027 CIT Services +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from ast import literal_eval + +from odoo.tests.common import TransactionCase + + +class TestOperatingUnitWindowActionIsolation(TransactionCase): + @classmethod + def setUpClass(cls): + super().setUpClass() + + cls.partner_a = cls.env["res.partner"].create({"name": "OU A Partner"}) + + cls.partner_b = cls.env["res.partner"].create({"name": "OU B Partner"}) + + cls.ou_a = cls.env["operating.unit"].create( + { + "name": "OU A", + "code": "OUA", + "partner_id": cls.partner_a.id, + } + ) + + cls.ou_b = cls.env["operating.unit"].create( + { + "name": "OU B", + "code": "OUB", + "partner_id": cls.partner_b.id, + } + ) + + internal_user_group = cls.env.ref("base.group_user") + settings_group = cls.env.ref("base.group_system") + + cls.user_a = cls.env["res.users"].create( + { + "name": "User A", + "login": "user_a", + "email": "user_a@example.com", + "groups_id": [ + ( + 6, + 0, + [ + internal_user_group.id, + settings_group.id, + ], + ) + ], + "default_operating_unit_id": cls.ou_a.id, + "operating_unit_ids": [(6, 0, [cls.ou_a.id])], + } + ) + + cls.user_b = cls.env["res.users"].create( + { + "name": "User B", + "login": "user_b", + "email": "user_b@example.com", + "groups_id": [ + ( + 6, + 0, + [ + internal_user_group.id, + settings_group.id, + ], + ) + ], + "default_operating_unit_id": cls.ou_b.id, + "operating_unit_ids": [(6, 0, [cls.ou_b.id])], + } + ) + + cls.user_without_default_ou = cls.env["res.users"].create( + { + "name": "User C", + "login": "user_c", + "email": "user_c@example.com", + "groups_id": [ + ( + 6, + 0, + [ + internal_user_group.id, + settings_group.id, + ], + ) + ], + "operating_unit_ids": [(6, 0, [cls.ou_a.id, cls.ou_b.id])], + } + ) + + # sale.order contains operating_unit_id + cls.action_without_domain = cls.env["ir.actions.act_window"].create( + { + "name": "Sale Orders", + "res_model": "sale.order", + "view_mode": "list,form", + } + ) + + cls.action_with_domain = cls.env["ir.actions.act_window"].create( + { + "name": "Sale Orders With Domain", + "res_model": "sale.order", + "view_mode": "list,form", + "domain": "[('state', '!=', 'cancel')]", + } + ) + + cls.action_without_ou_field = cls.env["ir.actions.act_window"].create( + { + "name": "Countries", + "res_model": "res.country", + "view_mode": "list,form", + } + ) + + def _normalize_domain(self, domain): + if isinstance(domain, str): + return literal_eval(domain) + return domain + + def test_superuser_not_filtered(self): + """Superuser must not receive OU domain.""" + values = self.action_without_domain.read()[0] + + self.assertFalse(values.get("domain")) + + def test_user_without_default_ou(self): + """No domain must be injected.""" + values = self.action_without_domain.with_user( + self.user_without_default_ou + ).read()[0] + + self.assertFalse(values.get("domain")) + + def test_model_without_operating_unit_field(self): + """Models without operating_unit_id are ignored.""" + values = self.action_without_ou_field.with_user(self.user_a).read()[0] + + self.assertFalse(values.get("domain")) + + def test_action_without_domain(self): + """OU domain must be created.""" + values = self.action_without_domain.with_user(self.user_a).read()[0] + + domain = self._normalize_domain(values.get("domain")) + + self.assertIn( + ( + "operating_unit_id", + "in", + [False, self.ou_a.id], + ), + domain, + ) + + def test_ou_a_domain_added(self): + """User A receives OU A domain.""" + values = self.action_without_domain.with_user(self.user_a).read()[0] + + domain = str(values["domain"]) + + self.assertIn( + str(self.ou_a.id), + domain, + ) + + def test_ou_b_domain_added(self): + """User B receives OU B domain.""" + values = self.action_without_domain.with_user(self.user_b).read()[0] + + domain = str(values["domain"]) + + self.assertIn( + str(self.ou_b.id), + domain, + ) + + def test_existing_domain_preserved(self): + """Original action domain must remain.""" + values = self.action_with_domain.with_user(self.user_a).read()[0] + + domain = str(values["domain"]) + + self.assertIn("state", domain) + self.assertIn( + "operating_unit_id", + domain, + ) + + def test_domain_contains_false_ou(self): + """Records without OU remain visible.""" + values = self.action_without_domain.with_user(self.user_a).read()[0] + + domain = str(values["domain"]) + + self.assertIn( + "[False", + domain, + )