[IMP] Newly created users get all manager access right

Coming from a bug in web_settings_dashboard. Invited user didn't have any rights
when created from the dashboard, which was leading to an error.

This bug leaded to a new discussion. Better to have basic employee having user
rights for all main applications. For bigger entreprises there is an admin that
will carefully remove extra rights, if necessary. The target is small businesses,
it makes sense that every way to create a user gives the same result.

In conclusion, each new user has a full access to the applications by default

How is it implemented ?
We added an inactive default user which original access right to the groups
'base.group_user' and 'base.group_partner_manager' in base. Each
application will extend the default user's access right by adding the maximal
access right for this application.

On user creation, we will use by default the 'group_id' field from the default
user. We will in the same time remove the ugly 'default_groups_ref' key which
was passed sometimes in the context for some fields in some views, and sometimes
nothing.

So, the user can modify the access rights for the default user, but he should be
aware that removing project user access rights for a default user will prevent
a *created on the fly in a task* user will not be able to access the task.

addons/account/security/account_security.xml

@@ -21,6 +21,10 @@
         <field name="implied_ids" eval="[(4, ref('group_account_user'))]"/>
     </record>
 
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('account.group_account_manager'))]"/>
+    </record>
+
     <record id="group_proforma_invoices" model="res.groups">
         <field name="name">Pro-forma Invoices</field>
         <field name="category_id" ref="base.module_category_hidden"/>

addons/event/security/event_security.xml

@@ -15,6 +15,10 @@
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
 
+        <record id="base.default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('event.group_event_manager'))]"/>
+        </record>
+
         <record id="group_email_scheduling" model="res.groups">
             <field name="name">Schedule Emails on Event Subscription</field>
             <field name="category_id" ref="base.module_category_hidden"/>

addons/fleet/security/fleet_security.xml

@@ -15,6 +15,9 @@
             <field name="category_id" ref="module_fleet_category"/>
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
+        <record id="base.default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('fleet.group_fleet_manager'))]"/>
+        </record>
     </data>
 
     <data noupdate="1">

addons/hr/security/hr_security.xml

@@ -20,6 +20,10 @@
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
     
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('base.group_hr_manager'))]"/>
+    </record>
+
     <record id="base.group_hr_attendance" model="res.groups">
         <field name="name">Attendances</field>
         <field name="category_id" ref="base.module_category_hidden"/>

addons/im_livechat/security/im_livechat_channel_security.xml

@@ -21,5 +21,9 @@
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
 
+        <record id="base.default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('im_livechat.im_livechat_group_manager'))]"/>
+        </record>
+
     </data>
 </odoo>

addons/lunch/security/lunch_security.xml

@@ -16,6 +16,10 @@
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
 
+        <record id="base.default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('lunch.group_lunch_manager'))]"/>
+        </record>
+
         <record id="lunch_mind_your_own_food_money" model="ir.rule">
             <field name="name">lunch.cashmove: do not see other people's cashmove</field>
             <field name="model_id" ref="model_lunch_cashmove"/>

addons/marketing_campaign/security/marketing_campaign_security.xml

@@ -12,5 +12,10 @@
         <field name="implied_ids" eval="[(4, ref('marketing_campaign.group_lead_automation_user'))]"/>
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
+
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('marketing_campaign.group_lead_automation_manager'))]"/>
+    </record>
+
     </data>
 </openerp>

addons/mass_mailing/security/mass_mailing_security.xml

@@ -7,6 +7,10 @@
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
 
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('mass_mailing.group_mass_mailing_user'))]"/>
+    </record>
+
     <record id="group_website_popup_on_exit" model="res.groups">
         <field name="name">Use subscription pop up on the website</field>
         <field name="category_id" ref="base.module_category_hidden"/>

addons/mrp/security/mrp_security.xml

@@ -14,6 +14,10 @@
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
 
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('mrp.group_mrp_manager'))]"/>
+    </record>
+
     <record id="group_mrp_routings" model="res.groups">
         <field name="name">Manage Work Order Operations</field>
         <field name="category_id" ref="base.module_category_hidden"/>

addons/point_of_sale/security/point_of_sale_security.xml

@@ -13,6 +13,10 @@
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
 
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('point_of_sale.group_pos_manager'))]"/>
+    </record>
+
     <record id="rule_pos_bank_statement_user" model="ir.rule">
         <field name="name">Point Of Sale Bank Statement POS User</field>
         <field name="model_id" ref="account.model_account_bank_statement" />

addons/project/security/project_security.xml

@@ -15,6 +15,10 @@
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
 
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('project.group_project_manager'))]"/>
+    </record>
+
     <record id="group_tasks_work_on_tasks" model="res.groups">
         <field name="name">Task's Work on Tasks</field>
         <field name="category_id" ref="base.module_category_hidden"/>

addons/purchase/security/purchase_security.xml

@@ -15,6 +15,10 @@
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
 
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('purchase.group_purchase_manager'))]"/>
+    </record>
+
     <record id="group_analytic_accounting" model="res.groups">
         <field name="name">Analytic Accounting for Purchases</field>
         <field name="category_id" ref="base.module_category_hidden"/>

addons/stock/security/stock_security.xml

@@ -18,6 +18,10 @@
         <field name="users" eval="[(4, ref('base.user_root'))]"/>
     </record>
 
+    <record id="base.default_user" model="res.users">
+        <field name="groups_id" eval="[(4,ref('stock.group_stock_manager'))]"/>
+    </record>
+
     <record id="group_production_lot" model="res.groups">
         <field name="name">Manage Lots / Serial Numbers</field>
         <field name="category_id" ref="base.module_category_hidden"/>

addons/survey/security/survey_security.xml

@@ -15,6 +15,10 @@
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
 
+        <record id="base.default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('base.group_survey_manager'))]"/>
+        </record>
+
         <!-- Record rules -->
         <record id="survey_users_access" model="ir.rule">
             <field name="name">Access to survey for regular users</field>

addons/website/data/data.xml

@@ -43,6 +43,10 @@
             <field name="category_id" ref="base.module_category_website"/>
         </record>
 
+        <record id="base.default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('base.group_website_designer'))]"/>
+        </record>
+
         <record id="action_module_website" model="ir.actions.act_window">
             <field name="name">Website Apps</field>
             <field name="res_model">ir.module.module</field>

openerp/addons/base/base_data.xml

@@ -51,6 +51,13 @@
 Administrator</span>]]></field>
         </record>
 
+        <!-- Default user with full access rights for newly created users -->
+        <record id="default_user" model="res.users">
+            <field name="name">default user</field>
+            <field name="login">default</field>
+            <field name="active" eval="False"/>
+        </record>
+
         <record id="main_partner" model="res.partner">
             <field name="company_id" ref="main_company"/>
         </record>

openerp/addons/base/res/res_users.py

@@ -262,16 +262,10 @@ class res_users(osv.osv):
         return False
 
     def _get_group(self,cr, uid, context=None):
-        dataobj = self.pool.get('ir.model.data')
-        result = []
-        try:
-            dummy,group_id = dataobj.get_object_reference(cr, SUPERUSER_ID, 'base', 'group_user')
-            result.append(group_id)
-            dummy,group_id = dataobj.get_object_reference(cr, SUPERUSER_ID, 'base', 'group_partner_manager')
-            result.append(group_id)
-        except ValueError:
-            # If these groups does not exists anymore
-            pass
+        default_user = self.pool['ir.model.data'].xmlid_to_object(cr, uid, 'base.default_user')
+        if not default_user:
+            return []
+        result = default_user.groups_id.ids
         return result
 
     _defaults = {

openerp/addons/base/security/base_security.xml

@@ -21,10 +21,18 @@
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
 
+        <record id="base.default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('base.group_system'))]"/>
+        </record>
+
         <record model="res.groups" id="group_user">
             <field name="name">Employee</field>
         </record>
 
+        <record id="default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('base.group_user'))]"/>
+        </record>
+
         <record model="res.groups" id="group_light_multi_company">
             <field name="name">Enable Light Multi Company</field>
         </record>
@@ -55,10 +63,18 @@
             <field name="implied_ids" eval="[(4, ref('group_sale_salesman'))]"/>
         </record>
 
+        <record id="default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('base.group_sale_manager'))]"/>
+        </record>
+
         <record model="res.groups" id="group_partner_manager">
             <field name="name">Contact Creation</field>
         </record>
 
+        <record id="default_user" model="res.users">
+            <field name="groups_id" eval="[(4,ref('base.group_partner_manager'))]"/>
+        </record>
+
         <!--
             A group dedicated to the portal users, making groups
             restrictions more convenient.