Skip to content

Commit

Permalink
[IMP] base_group_backend: pre-commit stuff
Browse files Browse the repository at this point in the history
  • Loading branch information
oury.balde committed Oct 21, 2024
1 parent 9899513 commit 05054fe
Show file tree
Hide file tree
Showing 14 changed files with 156 additions and 138 deletions.
129 changes: 71 additions & 58 deletions base_group_backend/README.rst
Original file line number Diff line number Diff line change
Expand Up @@ -17,69 +17,78 @@ Group backend
:target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
:alt: License: LGPL-3
.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--backend-lightgray.png?logo=github
:target: https://github.com/OCA/server-backend/tree/16.0/base_group_backend
:target: https://github.com/OCA/server-backend/tree/17.0/base_group_backend
:alt: OCA/server-backend
.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
:target: https://translation.odoo-community.org/projects/server-backend-16-0/server-backend-16-0-base_group_backend
:target: https://translation.odoo-community.org/projects/server-backend-17-0/server-backend-17-0-base_group_backend
:alt: Translate me on Weblate
.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
:target: https://runboat.odoo-community.org/builds?repo=OCA/server-backend&target_branch=16.0
:target: https://runboat.odoo-community.org/builds?repo=OCA/server-backend&target_branch=17.0
:alt: Try me on Runboat

|badge1| |badge2| |badge3| |badge4| |badge5|

This module was written to extend the standard functionality regarding users
and groups management by adding a new `Backend user` group that only gives access
to odoo backend (`/web`):
This module was written to extend the standard functionality regarding
users and groups management by adding a new Backend user group that only
gives access to odoo backend (/web):

* minimal default access:
* users and partners (this is necessary to access your own data)
* mail activity, notification and channel
* presence
* minimal default menu
* notification
* activities
* minimal default access rules
- minimal default access:

The problem with the `Internal user` is when you want to gives access to the
backend to a really thin part of your business to some users, it's quite hard
to properly maintain those roles over the project life, a lot of models use
that group (`base.group_user`) by default which makes hard to maintains.
- users and partners (this is necessary to access your own data)
- mail activity, notification and channel
- presence

So that helps creating well-defined user groups with more controls.
- minimal default menu

- notification
- activities

This modules does 3 things:
* It hijack the has_group method of res.users by returning True for group_backend users when the requested group is group_user (The need for this needs to be investigated)
* It sets the res_users.share to False for group_backend users. This allows those users to access the backend.
* It sets the bare minimum permission in the ir.model.access.csv to display the backend
- minimal default access rules

We suggest to use this module with its compagnon `base_user_role`
The problem with the Internal user is when you want to gives access to
the backend to a really thin part of your business to some users, it's
quite hard to properly maintain those roles over the project life, a lot
of models use that group (base.group_user) by default which makes hard
to maintains.

So that helps creating well-defined user groups with more controls.

Here is an example where a backend ui user can only access and use the dummy app. No other application are available to this user. You may define your own application instead of the dummy one.
This modules does 3 things: \* It hijack the has_group method of
res.users by returning True for group_backend users when the requested
group is group_user (The need for this needs to be investigated) \* It
sets the res_users.share to False for group_backend users. This allows
those users to access the backend. \* It sets the bare minimum
permission in the ir.model.access.csv to display the backend

.. figure:: https://raw.githubusercontent.com/OCA/server-backend/16.0/base_group_backend/static/description/dummy_app.png
:alt: Dummy app for demo
We suggest to use this module with its compagnon base_user_role

Here is an example where a backend ui user can only access and use the
dummy app. No other application are available to this user. You may
define your own application instead of the dummy one.

|image1|

Limitations
~~~~~~~~~~~
-----------

At the time of writing, Odoo uses `res.users.share == False` to give the
backend access.
However to be able to access the backend without any errors some basic rights are necessary.
This module change the way `res.users.share` is computed to allow `group_backend users` to use the backend.
At the time of writing, Odoo uses res.users.share == False to give the
backend access. However to be able to access the backend without any
errors some basic rights are necessary. This module change the way
res.users.share is computed to allow group_backend users to use the
backend.

This avoids to write a lot of overwrite in different controllers from
different modules ('portal', 'web', 'base', 'website') with hard coded statements
that check if user is part of the `base.group_user` or `share == False` group.
different modules ('portal', 'web', 'base', 'website') with hard coded
statements that check if user is part of the base.group_user or share ==
False group.

.. warning::

Using this module and grant a user with `group_backend`'s group is
equivalent to grant `group_user`'s group everywhere `has_group`
has been used.
Using this module and grant a user with group_backend's group is
equivalent to grant group_user's group everywhere has_group has been
used.

.. |image1| image:: https://raw.githubusercontent.com/OCA/server-backend/17.0/base_group_backend/static/description/dummy_app.png

.. IMPORTANT::
This is an alpha version, the data model and design can change at any time without warning.
Expand All @@ -94,35 +103,38 @@ that check if user is part of the `base.group_user` or `share == False` group.
Configuration
=============

To allow `group_backend` to interact with a model you can either add access rules to the group
or you can add `implied_ids` to `group_backend`.
To allow group_backend to interact with a model you can either add
access rules to the group or you can add implied_ids to group_backend.

.. note::

Be aware users can only belong to one group from the user type category
(`base.module_category_user_type`). So your other groups can't inherit both
internal users and backend users.
Be aware users can only belong to one group from the user type
category (base.module_category_user_type). So your other groups can't
inherit both internal users and backend users.

Usage
=====

To use this module, you need to:

#. Go to Configuration / Users / Users, choose a user and set the user type.
1. Go to Configuration / Users / Users, choose a user and set the user
type.

You get a users that is only able to access to the Odoo backend which
you can attach other groups that not implies other kind of users
(portal, internal users)

You get a users that is only able to access to the Odoo backend which you
can attach other groups that not implies other kind of users (`portal`,
`internal users`)
|image1|

.. figure:: https://raw.githubusercontent.com/OCA/server-backend/16.0/base_group_backend/static/description/backend_ui.png
:alt: Backend UI user
.. |image1| image:: https://raw.githubusercontent.com/OCA/server-backend/17.0/base_group_backend/static/description/backend_ui.png

Known issues / Roadmap
======================

Current module depends on `base_install_request` instead of `base`.
Current module depends on base_install_request instead of base.

We don't need `base_install_request` auto install module but we must override it to set a security group on `App` menu.
We don't need base_install_request auto install module but we must
override it to set a security group on App menu.

This dependency should be remove if possible in future versions.

Expand All @@ -132,28 +144,29 @@ Bug Tracker
Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-backend/issues>`_.
In case of trouble, please check there if your issue has already been reported.
If you spotted it first, help us to smash it by providing a detailed and welcomed
`feedback <https://github.com/OCA/server-backend/issues/new?body=module:%20base_group_backend%0Aversion:%2016.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
`feedback <https://github.com/OCA/server-backend/issues/new?body=module:%20base_group_backend%0Aversion:%2017.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.

Do not contact contributors directly about support or help with technical issues.

Credits
=======

Authors
~~~~~~~
-------

* Pierre Verkest

Contributors
~~~~~~~~~~~~
------------

* Pierre Verkest <[email protected]>
* François Poizat <[email protected]>
- Pierre Verkest <[email protected]>
- François Poizat <[email protected]>

Do not contact contributors directly about support or help with technical issues.
Do not contact contributors directly about support or help with
technical issues.

Maintainers
~~~~~~~~~~~
-----------

This module is maintained by the OCA.

Expand All @@ -176,6 +189,6 @@ Current `maintainers <https://odoo-community.org/page/maintainer-role>`__:

|maintainer-FranzPoize| |maintainer-bealdav|

This module is part of the `OCA/server-backend <https://github.com/OCA/server-backend/tree/16.0/base_group_backend>`_ project on GitHub.
This module is part of the `OCA/server-backend <https://github.com/OCA/server-backend/tree/17.0/base_group_backend>`_ project on GitHub.

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.
2 changes: 1 addition & 1 deletion base_group_backend/__manifest__.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html).
{
"name": "Group backend",
"version": "16.0.1.0.0",
"version": "17.0.1.0.0",
"development_status": "Alpha",
"category": "Tools",
"author": "Pierre Verkest, Odoo Community Association (OCA)",
Expand Down
3 changes: 3 additions & 0 deletions base_group_backend/pyproject.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
[build-system]
requires = ["whool"]
build-backend = "whool.buildapi"
7 changes: 7 additions & 0 deletions base_group_backend/readme/CONFIGURE.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
To allow group_backend to interact with a model you can either add
access rules to the group or you can add implied_ids to group_backend.

> [!NOTE]
> Be aware users can only belong to one group from the user type
> category (base.module_category_user_type). So your other groups can't
> inherit both internal users and backend users.
8 changes: 0 additions & 8 deletions base_group_backend/readme/CONFIGURE.rst

This file was deleted.

5 changes: 5 additions & 0 deletions base_group_backend/readme/CONTRIBUTORS.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
- Pierre Verkest \<<[email protected]>\>
- François Poizat \<<[email protected]>\>

Do not contact contributors directly about support or help with
technical issues.
4 changes: 0 additions & 4 deletions base_group_backend/readme/CONTRIBUTORS.rst

This file was deleted.

53 changes: 53 additions & 0 deletions base_group_backend/readme/DESCRIPTION.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
This module was written to extend the standard functionality regarding
users and groups management by adding a new Backend user group that only
gives access to odoo backend (/web):

- minimal default access:
- users and partners (this is necessary to access your own data)
- mail activity, notification and channel
- presence
- minimal default menu
- notification
- activities
- minimal default access rules

The problem with the Internal user is when you want to gives access to
the backend to a really thin part of your business to some users, it's
quite hard to properly maintain those roles over the project life, a lot
of models use that group (base.group_user) by default which makes hard
to maintains.

So that helps creating well-defined user groups with more controls.

This modules does 3 things: \* It hijack the has_group method of
res.users by returning True for group_backend users when the requested
group is group_user (The need for this needs to be investigated) \* It
sets the res_users.share to False for group_backend users. This allows
those users to access the backend. \* It sets the bare minimum
permission in the ir.model.access.csv to display the backend

We suggest to use this module with its compagnon base_user_role

Here is an example where a backend ui user can only access and use the
dummy app. No other application are available to this user. You may
define your own application instead of the dummy one.

![](../static/description/dummy_app.png)

## Limitations

At the time of writing, Odoo uses res.users.share == False to give the
backend access. However to be able to access the backend without any
errors some basic rights are necessary. This module change the way
res.users.share is computed to allow group_backend users to use the
backend.

This avoids to write a lot of overwrite in different controllers from
different modules ('portal', 'web', 'base', 'website') with hard coded
statements that check if user is part of the base.group_user or share ==
False group.

> [!WARNING]
> Using this module and grant a user with group_backend's group is
> equivalent to grant group_user's group everywhere has_group has been
> used.
52 changes: 0 additions & 52 deletions base_group_backend/readme/DESCRIPTION.rst

This file was deleted.

6 changes: 6 additions & 0 deletions base_group_backend/readme/ROADMAP.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
Current module depends on base_install_request instead of base.

We don't need base_install_request auto install module but we must
override it to set a security group on App menu.

This dependency should be remove if possible in future versions.
5 changes: 0 additions & 5 deletions base_group_backend/readme/ROADMAP.rst

This file was deleted.

10 changes: 10 additions & 0 deletions base_group_backend/readme/USAGE.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
To use this module, you need to:

1. Go to Configuration / Users / Users, choose a user and set the user
type.

You get a users that is only able to access to the Odoo backend which
you can attach other groups that not implies other kind of users
(portal, internal users)

![](../static/description/backend_ui.png)
10 changes: 0 additions & 10 deletions base_group_backend/readme/USAGE.rst

This file was deleted.

Binary file added pandoc-3.5-1-amd64.deb
Binary file not shown.

0 comments on commit 05054fe

Please sign in to comment.