[IMP] event_*: clean ACL and add a new group "Registration Desk"

Purpose
=======

Clean the ACLs related to the Event application.

Add a new group to manage the registration in the entrance of an event. This
group should not be able to modify or remove records in Event but should be
able to create and manage the registrations.

Specifications
==============

Now, there are 3 event groups

  * ``Registration Desk User``, who can manage the registrations and
    read all event-related information;
  * ``Event User`` who can create event, sponsor, ticket... His role is
    to globally handle events on a day-to-day basis;
  * ``Event Administrator`` who can create event type, sponsor type,
    ticket type... His role is to manage the way events are managed withint
    its company:

Each group implies all previous groups.

Compared to previous event users gain a lot of rules, allowing to update
records like tickets, registrations, ... Low-end event users should now
use the registration desk group.

Links
=====

Task ID-2204364
COM odoo/odoo#57022
ENT odoo/enterprise#13984
UPG odoo/upgrade#1897

addons/event/models/event_event.py

@@ -523,6 +523,19 @@ class EventEvent(models.Model):
         default = dict(default or {}, name=_("%s (copy)") % (self.name))
         return super(EventEvent, self).copy(default)
 
+    @api.model
+    def _get_mail_message_access(self, res_ids, operation, model_name=None):
+        if (
+            operation == 'create'
+            and self.env.user.has_group('event.group_event_registration_desk')
+            and (not model_name or model_name == 'event.event')
+        ):
+            # allow the registration desk users to post messages on Event
+            # can not be done with "_mail_post_access" otherwise public user will be
+            # able to post on published Event (see website_event)
+            return 'read'
+        return super(EventEvent, self)._get_mail_message_access(res_ids, operation, model_name)
+
     def _sync_required_computed(self, values):
         # TODO: See if the change to seats_limited affects this ?
         """ Call compute fields in cache to find missing values for required fields

addons/event/models/res_partner.py

@@ -1,20 +1,18 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from odoo import api, fields, models
+from odoo import fields, models
 
 
 class ResPartner(models.Model):
     _inherit = 'res.partner'
 
     event_count = fields.Integer(
-        '# Events', compute='_compute_event_count', groups='event.group_event_user',
+        '# Events', compute='_compute_event_count', groups='event.group_event_registration_desk',
         help='Number of events the partner has participated.')
 
     def _compute_event_count(self):
         self.event_count = 0
-        if not self.user_has_groups('event.group_event_user'):
-            return
         for partner in self:
             partner.event_count = self.env['event.event'].search_count([('registration_ids.partner_id', 'child_of', partner.ids)])
 

addons/event/security/event_security.xml

@@ -6,9 +6,15 @@
             <field name="sequence">18</field>
         </record>
 
+        <record id="group_event_registration_desk" model="res.groups">
+            <field name="name">Registration Desk</field>
+            <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
+            <field name="category_id" ref="base.module_category_marketing_events"/>
+        </record>
+
         <record id="group_event_user" model="res.groups">
             <field name="name">User</field>
-            <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
+            <field name="implied_ids" eval="[(4, ref('group_event_registration_desk'))]"/>
             <field name="category_id" ref="base.module_category_marketing_events"/>
         </record>
 

addons/event/security/ir.model.access.csv

@@ -1,24 +1,27 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_event_type_user,event.type.user,model_event_type,event.group_event_user,1,0,0,0
+access_event_type_registration,event.type.registration,model_event_type,event.group_event_registration_desk,1,0,0,0
 access_event_type_manager,event.type.manager,model_event_type,event.group_event_manager,1,1,1,1
-access_event_type_ticket_user,event.type.ticket.user,model_event_type_ticket,event.group_event_user,1,0,0,0
+access_event_type_ticket_registration,event.type.ticket.registration,model_event_type_ticket,event.group_event_registration_desk,1,0,0,0
 access_event_type_ticket_manager,event.type.ticket.manager,model_event_type_ticket,event.group_event_manager,1,1,1,1
-access_event_event,event.event,model_event_event,,1,0,0,0
-access_event_event_user,event.event.user,model_event_event,event.group_event_user,1,0,0,0
+access_event_event_registration,event.event.registration,model_event_event,event.group_event_registration_desk,1,0,0,0
+access_event_event_user,event.event.user,model_event_event,event.group_event_user,1,1,1,0
 access_event_event_manager,event.event.manager,model_event_event,event.group_event_manager,1,1,1,1
-access_event_event_ticket_user,event.event.ticket.user,model_event_event_ticket,event.group_event_user,1,0,0,0
-access_event_event_ticket_manager,event.event.ticket.manager,model_event_event_ticket,event.group_event_manager,1,1,1,1
-access_event_registration_user,event.registration.user,model_event_registration,event.group_event_user,1,1,1,1
+access_event_event_ticket,event.event.ticket,model_event_event_ticket,,0,0,0,0
+access_event_event_ticket_user,event.event.ticket.user,model_event_event_ticket,event.group_event_user,1,1,1,1
 access_event_registration,event.registration,model_event_registration,,0,0,0,0
-access_event_mail_user,event.mail.user,model_event_mail,event.group_event_user,1,0,0,0
-access_event_mail_manager,event.mail.manager,model_event_mail,event.group_event_manager,1,1,1,1
-access_event_mail_registration_user,event.mail.registration.user,model_event_mail_registration,event.group_event_user,1,0,0,0
+access_event_registration_registration,event.registration.registration,model_event_registration,event.group_event_registration_desk,1,1,1,0
+access_event_registration_manager,event.registration.manager,model_event_registration,event.group_event_manager,1,1,1,1
+access_event_mail_registration,event.mail.registration,model_event_mail,event.group_event_registration_desk,1,0,0,0
+access_event_mail_user,event.mail.user,model_event_mail,event.group_event_user,1,1,1,1
+access_event_mail_registration_registration,event.mail.registration.registration,model_event_mail_registration,event.group_event_registration_desk,1,0,0,0
 access_event_mail_registration_manager,event.mail.registration.manager,model_event_mail_registration,event.group_event_manager,1,1,1,1
-access_event_type_mail_user,event.type.mail.user,model_event_type_mail,event.group_event_user,1,0,0,0
+access_event_type_mail_registration,event.type.mail.registration,model_event_type_mail,event.group_event_registration_desk,1,0,0,0
 access_event_type_mail_manager,event.type.mail.manager,model_event_type_mail,event.group_event_manager,1,1,1,1
-access_event_stage_user,event.stage.user,model_event_stage,event.group_event_user,1,1,1,1
+access_event_stage_registration,event.stage.registration,model_event_stage,event.group_event_registration_desk,1,0,0,0
 access_event_stage_manager,event.stage.manager,model_event_stage,event.group_event_manager,1,1,1,1
-access_event_tag_category_user,event.tag.category.user,model_event_tag_category,event.group_event_user,1,0,0,0
-access_event_tag_category_manager,event.tag.category.manager,model_event_tag_category,event.group_event_manager,1,1,1,1
-access_event_tag_user,event.tag.user,model_event_tag,event.group_event_user,1,1,0,0
+access_event_tag_category_registration,event.tag.category.registration,model_event_tag_category,event.group_event_registration_desk,1,0,0,0
+access_event_tag_category_user,event.tag.category.user,model_event_tag_category,event.group_event_user,1,1,1,1
+access_event_tag,event.tag,model_event_tag,,0,0,0,0
+access_event_tag_registration,event.tag.user,model_event_tag,event.group_event_registration_desk,1,0,0,0
+access_event_tag_user,event.tag.user,model_event_tag,event.group_event_user,1,1,1,0
 access_event_tag_manager,event.tag.manager,model_event_tag,event.group_event_manager,1,1,1,1

addons/event/tests/common.py

@@ -27,6 +27,13 @@ class TestEventCommon(common.TransactionCase):
             company_id=cls.env.ref("base.main_company").id,
             groups='base.group_user',
         )
+        cls.user_eventregistrationdesk = mail_new_test_user(
+            cls.env, login='user_eventregistrationdesk',
+            name='Ursule EventRegistration', email='ursule.eventregistration@test.example.com',
+            tz='Europe/Brussels', notification_type='inbox',
+            company_id=cls.env.ref("base.main_company").id,
+            groups='base.group_user,event.group_event_registration_desk',
+        )
         cls.user_eventuser = mail_new_test_user(
             cls.env, login='user_eventuser',
             name='Ursule EventUser', email='ursule.eventuser@test.example.com',

addons/event/views/event_menu_views.xml

@@ -5,7 +5,7 @@
     <menuitem name="Events"
         id="event_main_menu"
         sequence="65"
-        groups="event.group_event_user"
+        groups="event.group_event_registration_desk"
         web_icon="event,static/description/icon.png"/>
 
     <!-- HEADER: EVENTS -->
@@ -13,14 +13,14 @@
         id="menu_event_event"
         sequence="1"
         parent="event.event_main_menu"
-        groups="event.group_event_user"/>
+        groups="event.group_event_registration_desk"/>
 
     <!-- HEADER: REPORTING -->
     <menuitem name="Reporting"
         id="menu_reporting_events"
         sequence="50"
         parent="event_main_menu"
-        groups="event.group_event_manager"/>
+        groups="event.group_event_user"/>
 
     <!-- HEADER: CONFIGURATION -->
     <menuitem name="Configuration"

addons/event/views/event_views.xml

@@ -501,7 +501,7 @@
             action="event_event_action_pivot"
             sequence="3"
             parent="event.menu_reporting_events"
-            groups="event.group_event_manager"/>
+            groups="event.group_event_user"/>
 
         <!-- EVENT.REGISTRATION VIEWS -->
         <record model="ir.ui.view" id="view_event_registration_tree">
@@ -739,7 +739,7 @@
             parent="event.menu_reporting_events"
             sequence="4"
             action="action_registration"
-            groups="event.group_event_manager"/>
+            groups="event.group_event_user"/>
 
         <!-- EVENT.MAIL VIEWS -->
         <record model="ir.ui.view" id="view_event_mail_form">

addons/event_crm/models/crm_lead.py

@@ -11,11 +11,11 @@ class Lead(models.Model):
     event_id = fields.Many2one('event.event', string="Source Event", help="Event triggering the rule that created this lead")
     registration_ids = fields.Many2many(
         'event.registration', string="Source Registrations",
-        groups='event.group_event_user',
+        groups='event.group_event_registration_desk',
         help="Registrations triggering the rule that created this lead")
     registration_count = fields.Integer(
         string="# Registrations", compute='_compute_registration_count',
-        groups='event.group_event_user',
+        groups='event.group_event_registration_desk',
         help="Counter for the registrations linked to this lead")
 
     @api.depends('registration_ids')

addons/event_crm/models/event_registration.py

@@ -14,7 +14,7 @@ class EventRegistration(models.Model):
         groups='sales_team.group_sale_salesman',
         help="Leads generated from the registration.")
     lead_count = fields.Integer(
-        '# Leads', compute='_compute_lead_count', groups='sales_team.group_sale_salesman',
+        '# Leads', compute='_compute_lead_count', compute_sudo=True,
         help="Counter for the leads linked to this registration")
 
     @api.depends('lead_ids')
@@ -57,7 +57,7 @@ class EventRegistration(models.Model):
         """
         to_update, event_lead_rule_skip = False, self.env.context.get('event_lead_rule_skip')
         if not event_lead_rule_skip:
-            to_update = self.filtered(lambda reg: reg.lead_ids)
+            to_update = self.filtered(lambda reg: reg.lead_count)
         if to_update:
             lead_tracked_vals = to_update._get_lead_tracked_values()
 

addons/event_crm/security/ir.model.access.csv

@@ -1,4 +1,5 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_event_crm_manager,event.lead.rule.manager,model_event_lead_rule,event.group_event_manager,1,1,1,1
+access_event_crm_registration,event.lead.rule.user,model_event_lead_rule,event.group_event_registration_desk,1,0,0,0
 access_event_crm_user,event.lead.rule.user,model_event_lead_rule,event.group_event_user,1,0,0,0
+access_event_crm_manager,event.lead.rule.manager,model_event_lead_rule,event.group_event_manager,1,1,1,1
 access_event_crm_salesman,event.lead.rule.salesman,model_event_lead_rule,sales_team.group_sale_salesman,1,0,0,0

addons/event_crm/tests/test_event_crm_flow.py

@@ -24,7 +24,7 @@ class TestEventCrmFlow(TestEventCrmCommon):
         self.assertEqual(self.event_customer.phone, '0485112233')
         self.assertFalse(self.event_customer.mobile)
 
-    @users('user_eventmanager')
+    @users('user_eventregistrationdesk')
     def test_event_crm_flow_batch_create(self):
         """ Test attendee- and order-based registrations creation. Event-based
         creation mimics a simplified website_event flow where grouping is done
@@ -58,7 +58,7 @@ class TestEventCrmFlow(TestEventCrmCommon):
         # ensuring filtering out worked also at description level
         self.assertNotIn('invalid@not.example.com', lead.description)
 
-    @users('user_eventmanager')
+    @users('user_eventregistrationdesk')
     def test_event_crm_flow_batch_update(self):
         """ Test update of contact or description fields that leads to lead
         update. """
@@ -96,7 +96,7 @@ class TestEventCrmFlow(TestEventCrmCommon):
         # ensuring filtering out worked also at description level
         self.assertNotIn('invalid@not.example.com', lead.description)
 
-    @users('user_eventmanager')
+    @users('user_eventregistrationdesk')
     def test_event_crm_flow_per_attendee_single(self):
         self.assert_initial_data()
 
@@ -145,3 +145,24 @@ class TestEventCrmFlow(TestEventCrmCommon):
         })
         self.assertEqual(len(self.event_0.registration_ids), 4)
         self.assertLeadConvertion(self.test_rule_attendee, registration, partner=None)
+
+    @users('user_eventregistrationdesk')
+    def test_event_crm_trigger_done(self):
+        """Test the case when the "crm.lead.rule" is executed when we write on the
+        registration state. """
+        registration = self.env['event.registration'].create({
+            'partner_id': self.event_customer.id,
+            'email': 'trigger.test@not.test.example.com',
+            'phone': False,
+            'mobile': '0456112233',
+            'event_id': self.event_0.id,
+        })
+
+        leads = self.env['crm.lead'].sudo().search([
+            ('registration_ids', 'in', registration.ids),
+        ])
+        self.assertFalse(leads, 'The lead must not be created yet')
+
+        registration.action_set_done()
+
+        self.assertLeadConvertion(self.test_rule_order_done, registration)

addons/event_sale/security/event_security.xml

@@ -2,7 +2,7 @@
 <odoo>
     <data noupdate="0">
         <record id="sales_team.group_sale_salesman" model="res.groups">
-            <field name="implied_ids" eval="[(4, ref('event.group_event_user'))]"/>
+            <field name="implied_ids" eval="[(4, ref('event.group_event_registration_desk'))]"/>
         </record>
     </data>
 </odoo>

addons/event_sale/views/event_registration_views.xml

@@ -37,7 +37,8 @@
         <field name="arch" type="xml">
             <xpath expr="//div[@name='button_box']" position="inside">
                 <button name="action_view_sale_order" type="object"
-                        class="oe_stat_button" icon="fa-usd" string="Sale Order">
+                        class="oe_stat_button" icon="fa-usd" string="Sale Order"
+                        groups="sales_team.group_sale_salesman">
                 </button>
             </xpath>
             <xpath expr="//group" position="before">

addons/test_event_full/tests/test_event_security.py

@@ -15,12 +15,11 @@ class TestEventSecurity(TestEventCommon):
     @users('user_employee')
     @mute_logger('odoo.models.unlink', 'odoo.addons.base.models.ir_model')
     def test_event_access_employee(self):
-        # employee can read events (sure ?)
+        # Event: read ok
         event = self.event_0.with_user(self.env.user)
         event.read(['name'])
-        # event.stage_id.read(['name', 'description'])
-        # event.event_type_id.read(['name', 'has_seats_limitation'])
 
+        # Event: read only
         with self.assertRaises(AccessError):
             self.env['event.event'].create({
                 'name': 'TestEvent',
@@ -29,39 +28,80 @@ class TestEventSecurity(TestEventCommon):
                 'seats_limited': True,
                 'seats_max': 10,
             })
-
         with self.assertRaises(AccessError):
             event.write({
                 'name': 'TestEvent Modified',
             })
 
+        # Event Type
+        with self.assertRaises(AccessError):
+            self.event_type_complex.with_user(self.env.user).read(['name'])
+        with self.assertRaises(AccessError):
+            self.event_type_complex.with_user(self.env.user).write({'name': 'Test Write'})
+
+        # Event Stage
         with self.assertRaises(AccessError):
             self.env['event.stage'].create({
                 'name': 'TestStage',
             })
 
-    @users('user_eventuser')
+        # Event Registration
+        with self.assertRaises(AccessError):
+            self.env['event.registration'].search([])
+
+    @users('user_eventregistrationdesk')
     @mute_logger('odoo.models.unlink', 'odoo.addons.base.models.ir_model')
-    def test_event_access_event_user(self):
+    def test_event_access_event_registration(self):
+        # Event: read ok
         event = self.event_0.with_user(self.env.user)
         event.read(['name', 'user_id', 'kanban_state_label'])
 
+        # Event: read only
         with self.assertRaises(AccessError):
-            self.env['event.event'].create({
-                'name': 'TestEvent',
-                'date_begin': datetime.now() + relativedelta(days=-1),
-                'date_end': datetime.now() + relativedelta(days=1),
-            })
+            event.name = 'Test'
+        with self.assertRaises(AccessError):
+            event.unlink()
 
+        # Event Registration
+        registration = self.env['event.registration'].create({
+            'event_id': self.event_0.id,
+        })
+        self.assertEqual(registration.event_id.name, self.event_0.name, 'Registration users should be able to read')
+        registration.name = 'Test write'
         with self.assertRaises(AccessError):
-            event.write({
-                'name': 'TestEvent Modified',
+            registration.unlink()
+
+    @users('user_eventuser')
+    @mute_logger('odoo.models.unlink', 'odoo.addons.base.models.ir_model')
+    def test_event_access_event_user(self):
+        # Event
+        event = self.event_0.with_user(self.env.user)
+        event.read(['name', 'user_id', 'kanban_state_label'])
+        event.write({'name': 'New name'})
+        self.env['event.event'].create({
+            'name': 'Event',
+            'date_begin': datetime.now() + relativedelta(days=-1),
+            'date_end': datetime.now() + relativedelta(days=1),
+        })
+
+        # Event: cannot unlink
+        with self.assertRaises(AccessError):
+            event.unlink()
+
+        # Event Type
+        with self.assertRaises(AccessError):
+            self.env['event.type'].create({
+                'name': 'ManagerEventType',
+                'use_mail_schedule': True,
+                'event_type_mail_ids': [(5, 0), (0, 0, {
+                    'interval_nbr': 1, 'interval_unit': 'days', 'interval_type': 'before_event',
+                    'template_id': self.env['ir.model.data'].xmlid_to_res_id('event.event_reminder')})]
             })
 
     @users('user_eventmanager')
     @mute_logger('odoo.models.unlink', 'odoo.addons.base.models.ir_model')
     def test_event_access_event_manager(self):
-        # EventManager can do about everything
+        # Event Type
         event_type = self.env['event.type'].create({
             'name': 'ManagerEventType',
             'use_mail_schedule': True,
@@ -69,21 +109,26 @@ class TestEventSecurity(TestEventCommon):
                 'interval_nbr': 1, 'interval_unit': 'days', 'interval_type': 'before_event',
                 'template_id': self.env['ir.model.data'].xmlid_to_res_id('event.event_reminder')})]
         })
+        event_type.write({'name': 'New Name'})
+
+        # Event
         event = self.env['event.event'].create({
             'name': 'ManagerEvent',
-            'event_type_id': event_type.id,
             'date_begin': datetime.now() + relativedelta(days=-1),
             'date_end': datetime.now() + relativedelta(days=1),
         })
+        event.write({'name': 'New Event Name'})
 
-        registration = self.env['event.registration'].create({'event_id': event.id, 'name': 'Myself'})
-        registration.write({'name': 'Myself2'})
-
+        # Event Stage
         stage = self.env['event.stage'].create({'name': 'test'})
         stage.write({'name': 'ManagerTest'})
         event.write({'stage_id': stage.id})
 
+        # Event Registration
+        registration = self.env['event.registration'].create({'event_id': event.id, 'name': 'Myself'})
+        registration.write({'name': 'Myself2'})
         registration.unlink()
+
         event.unlink()
         stage.unlink()
         event_type.unlink()
@@ -97,3 +142,73 @@ class TestEventSecurity(TestEventCommon):
             event_config = self.env['res.config.settings'].with_user(self.user_eventmanager).create({
             })
             event_config.execute()
+
+    def test_implied_groups(self):
+        """Test that the implied groups are correctly set.
+
+        - Event Manager imply Event User
+        - Event User imply Registration user
+        """
+        # Event Manager
+        self.assertTrue(
+            self.user_eventmanager.has_group('event.group_event_user'),
+            'The event manager group must imply the event user group')
+        self.assertTrue(
+            self.user_eventmanager.has_group('event.group_event_registration_desk'),
+            'The event manager group must imply the registration user group')
+
+        # Event User
+        self.assertTrue(
+            self.user_eventuser.has_group('event.group_event_registration_desk'),
+            'The event user group must imply the event user group')
+        self.assertFalse(
+            self.user_eventuser.has_group('event.group_event_manager'),
+            'The event user group must not imply the event user group')
+
+        # Registration User
+        self.assertFalse(
+            self.user_eventregistrationdesk.has_group('event.group_event_manager'),
+            'The event registration group must not imply the event user manager')
+        self.assertFalse(
+            self.user_eventregistrationdesk.has_group('event.group_event_user'),
+            'The event registration group must not imply the event user group')
+
+    def test_multi_companies(self):
+        """Test ACLs with multi company. """
+        company_1 = self.env.ref("base.main_company")
+        company_2 = self.env['res.company'].create({'name': 'Company 2'})
+        user_company_1 = self.user_eventuser
+
+        event_company_1, event_company_2 = self.env['event.event'].create([
+            {
+                'name': 'Event Company 1',
+                'date_begin': datetime.now() + relativedelta(days=-1),
+                'date_end': datetime.now() + relativedelta(days=1),
+                'company_id': company_1.id,
+            }, {
+                'name': 'Event Company 2',
+                'date_begin': datetime.now() + relativedelta(days=-1),
+                'date_end': datetime.now() + relativedelta(days=1),
+                'company_id': company_2.id,
+            }
+        ])
+
+        registration_company_1, registration_company_2 = self.env['event.registration'].create([
+            {
+                'name': 'Registration Company 1',
+                'event_id': event_company_1.id,
+                'company_id': company_1.id,
+            }, {
+                'name': 'Registration Company 2',
+                'event_id': event_company_2.id,
+                'company_id': company_2.id,
+            }
+        ])
+
+        result = self.env['event.event'].with_user(user_company_1).search([])
+        self.assertIn(event_company_1, result, 'You must be able to read the events in your company')
+        self.assertNotIn(event_company_2, result, 'You must not be able to read events outside of your company')
+
+        result = self.env['event.registration'].with_user(user_company_1).search([])
+        self.assertIn(registration_company_1, result, 'You must be able to read the registrations in your company')
+        self.assertNotIn(registration_company_2, result, 'You must not be able to read registrations outside of your company')

addons/website_event/models/event_event.py

@@ -315,8 +315,9 @@ class Event(models.Model):
 
         :param menu_type: type of menu. Mainly used for inheritance purpose
           allowing more fine-grain tuning of menus. """
+        self.check_access_rights('write')
         if not url:
-            self.env['ir.ui.view'].with_context(_force_unlink=True).search([('name', '=', name + ' ' + self.name)]).unlink()
+            self.env['ir.ui.view'].with_context(_force_unlink=True).sudo().search([('name', '=', name + ' ' + self.name)]).unlink()
             page_result = self.env['website'].sudo().new_page(name + ' ' + self.name, template=xml_id, ispage=False)
             url = "/event/" + slug(self) + "/page" + page_result['url']  # url contains starting "/"
         website_menu = self.env['website.menu'].sudo().create({

addons/website_event/models/website_visitor.py

@@ -13,15 +13,15 @@ class WebsiteVisitor(models.Model):
         help="Main identity")
     event_registration_ids = fields.One2many(
         'event.registration', 'visitor_id', string='Event Registrations',
-        groups="event.group_event_user")
+        groups="event.group_event_registration_desk")
     event_registration_count = fields.Integer(
         '# Registrations', compute='_compute_event_registration_count',
-        groups="event.group_event_user")
+        groups="event.group_event_registration_desk")
     event_registered_ids = fields.Many2many(
         'event.event', string="Registered Events",
         compute="_compute_event_registered_ids", compute_sudo=True,
         search="_search_event_registered_ids",
-        groups="event.group_event_user")
+        groups="event.group_event_registration_desk")
 
     @api.depends('event_registration_ids')
     def _compute_event_registration_count(self):

addons/website_event/security/ir.model.access.csv

@@ -1,11 +1,8 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_event_event_public,event.event.public,event.model_event_event,base.group_public,1,0,0,0
-access_event_event_portal,event.event.portal,event.model_event_event,base.group_portal,1,0,0,0
+access_event_event,event.event,model_event_event,,1,0,0,0
 access_event_type,event.type,event.model_event_type,,0,0,0,0
-access_event_event_ticket_public,event.event.ticket.public,event.model_event_event_ticket,base.group_public,1,0,0,0
-access_event_event_ticket_portal,event.event.ticket.portal,event.model_event_event_ticket,base.group_portal,1,0,0,0
 access_event_tag_category,event.tag.category,event.model_event_tag_category,,1,0,0,0
 access_event_tag,event.tag,event.model_event_tag,,1,0,0,0
 access_website_event_menu,website.event.menu,model_website_event_menu,,1,0,0,0
-access_website_event_menu_manager,website.event.menu.manager,model_website_event_menu,event.group_event_manager,1,1,1,1
+access_website_event_menu_user,website.event.menu.user,model_website_event_menu,event.group_event_user,1,1,1,1
 access_website_visitor_user,website.visitor.user,model_website_visitor,event.group_event_user,1,1,0,0

addons/website_event/views/event_templates_list.xml

@@ -155,7 +155,7 @@
     <t t-if="not event_ids">
         <div class="col-12">
             <div class="h2 mb-3">No events found.</div>
-            <div class="alert alert-info text-center" groups="event.group_event_manager">
+            <div class="alert alert-info text-center" groups="event.group_event_user">
                 <p class="m-0">Use the top button '<b>+ New</b>' to create an event.</p>
             </div>
         </div>

addons/website_event_exhibitor/views/event_exhibitor_templates_list.xml

@@ -123,7 +123,7 @@
             <div t-if="search_key" class="alert alert-info text-center">
                 <p class="m-0">We did not find any exhibitor matching your <strong t-esc="search_key"/> search.</p>
             </div>
-            <div t-else="" class="alert alert-info text-center" groups="event.group_event_manager">
+            <div t-else="" class="alert alert-info text-center" groups="event.group_event_user">
                 <p class="m-0">Add some exhibitors to get started !</p>
             </div>
         </div>

addons/website_event_meet/security/ir.model.access.csv

@@ -1,6 +1,5 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_event_meeting_room,event.meeting.room,model_event_meeting_room,,1,0,0,0
-access_event_meeting_room_user,event.meeting.room.user,model_event_meeting_room,event.group_event_user,1,0,0,0
-access_event_meeting_room_manager,event.meeting.room.manager,model_event_meeting_room,event.group_event_manager,1,1,1,1
-access_chat_room_user,chat.room.user,website_jitsi.model_chat_room,event.group_event_user,1,0,0,0
-access_chat_room_manager,chat.room.manager,website_jitsi.model_chat_room,event.group_event_manager,1,1,1,1
+access_event_meeting_room_user,event.meeting.room.user,model_event_meeting_room,event.group_event_user,1,1,1,1
+access_chat_room_registration,chat.room.registration,website_jitsi.model_chat_room,event.group_event_registration_desk,1,0,0,0
+access_chat_room_user,chat.room.user,website_jitsi.model_chat_room,event.group_event_user,1,1,1,1

addons/website_event_questions/security/ir.model.access.csv

@@ -2,5 +2,6 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_event_question,event.question,model_event_question,,1,0,0,0
 access_event_question_user,event.question.user,model_event_question,event.group_event_user,1,1,1,1
 access_event_question_answer,event.question.answer,model_event_question_answer,,1,0,0,0
+access_event_question_answer_registration,event.question.answer.registration,model_event_question_answer,event.group_event_registration_desk,1,1,0,0
 access_event_question_answer_user,event.question.answer.user,model_event_question_answer,event.group_event_user,1,1,1,1
-access_event_registration_answer_user,event.registration.answer.user,model_event_registration_answer,event.group_event_user,1,1,1,1
+access_event_registration_answer_registration,event.registration.answer.registration,model_event_registration_answer,event.group_event_registration_desk,1,1,1,1

addons/website_event_questions/security/security.xml

@@ -15,7 +15,7 @@
         <field name="name">Event Question: event user: read all</field>
         <field name="model_id" ref="website_event_questions.model_event_question"/>
         <field name="domain_force">[(1, '=', 1)]</field>
-        <field name="groups" eval="[(4, ref('event.group_event_user'))]"/>
+        <field name="groups" eval="[(4, ref('event.group_event_registration_desk'))]"/>
         <field name="perm_read" eval="True"/>
         <field name="perm_write" eval="False"/>
         <field name="perm_create" eval="False"/>
@@ -36,7 +36,7 @@
         <field name="name">Event Question Answer: event user: read all</field>
         <field name="model_id" ref="website_event_questions.model_event_question_answer"/>
         <field name="domain_force">[(1, '=', 1)]</field>
-        <field name="groups" eval="[(4, ref('event.group_event_user'))]"/>
+        <field name="groups" eval="[(4, ref('event.group_event_registration_desk'))]"/>
         <field name="perm_read" eval="True"/>
         <field name="perm_write" eval="False"/>
         <field name="perm_create" eval="False"/>

addons/website_event_sale/__manifest__.py

@@ -14,6 +14,7 @@ Sell event tickets through eCommerce app.
         'views/event_event_views.xml',
         'views/website_event_templates.xml',
         'views/website_sale_templates.xml',
+        'security/ir.model.access.csv',
         'security/website_event_sale_security.xml',
     ],
     'auto_install': True,

addons/website_event_sale/security/ir.model.access.csv

@@ -0,0 +1,2 @@
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_event_event_ticket,event.event.ticket,event.model_event_event_ticket,,1,0,0,0

addons/website_event_track/security/ir.model.access.csv

@@ -1,14 +1,16 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_event_track_manager,event.track.manager,model_event_track,event.group_event_manager,1,1,1,1
 access_event_track,event.track,model_event_track,,1,0,0,0
+access_event_track_user,event.track.user,model_event_track,event.group_event_user,1,1,1,0
+access_event_track_manager,event.track.manager,model_event_track,event.group_event_manager,1,1,1,1
 access_event_track_tag,event.track.tag,model_event_track_tag,,1,0,0,0
-access_event_track_tag_user,event.track.tag.user,model_event_track_tag,event.group_event_user,1,1,0,0
+access_event_track_tag_user,event.track.tag.user,model_event_track_tag,event.group_event_user,1,1,1,0
 access_event_track_tag_manager,event.track.tag.manager,model_event_track_tag,event.group_event_manager,1,1,1,1
 access_event_track_location,event.track.location,model_event_track_location,,1,0,0,0
+access_event_track_location_user,event.track.location.user,model_event_track_location,event.group_event_user,1,1,1,0
 access_event_track_location_manager,event.track.location.manager,model_event_track_location,event.group_event_manager,1,1,1,1
 access_event_track_stage,event.track.stage,model_event_track_stage,,1,0,0,0
 access_event_track_stage_manager,event.track.stage.manager,model_event_track_stage,event.group_event_manager,1,1,1,1
 access_event_track_visitor,event.track.visitor,model_event_track_visitor,,0,0,0,0
 access_event_track_visitor_manager,event.track.visitor.manager,model_event_track_visitor,event.group_event_manager,1,1,1,1
 access_event_track_tag_category,event.track.tag.category,model_event_track_tag_category,,1,0,0,0
-access_event_track_tag_category_manager,event.track.tag.category.manager,model_event_track_tag_category,event.group_event_manager,1,1,1,1
+access_event_track_tag_category_user,event.track.tag.category.user,model_event_track_tag_category,event.group_event_user,1,1,1,1

addons/website_event_track/views/event_track_templates_agenda.xml

@@ -65,7 +65,7 @@
         <div t-if="search_key" class="alert alert-info text-center">
             <p class="m-0">We did not find any track matching your <strong t-esc="search_key"/> search.</p>
         </div>
-        <div t-else="" class="alert alert-info text-center" groups="event.group_event_manager">
+        <div t-else="" class="alert alert-info text-center" groups="event.group_event_user">
             <p class="m-0">Schedule some tracks to get started !</p>
         </div>
     </div>

addons/website_event_track/views/event_track_templates_list.xml

@@ -123,7 +123,7 @@
             <div t-if="search_key" class="alert alert-info text-center">
                 <p class="m-0">We did not find any track matching your <strong t-esc="search_key"/> search.</p>
             </div>
-            <div t-else="" class="alert alert-info text-center" groups="event.group_event_manager">
+            <div t-else="" class="alert alert-info text-center" groups="event.group_event_user">
                 <p class="m-0">Schedule some tracks to get started !</p>
             </div>
         </div>

addons/website_event_track/views/event_track_views.xml

@@ -133,7 +133,8 @@
                         <button name="%(website_event_track.website_visitor_action_from_track)d"
                             type="action"
                             class="oe_stat_button"
-                            icon="fa-bell">
+                            icon="fa-bell"
+                            groups="event.group_event_user">
                             <field name="wishlist_visitor_count" string="Wishlisted By" widget="statinfo"/>
                         </button>
                         <field name="is_published" widget="website_redirect_button"/>

addons/website_event_track_quiz/security/ir.model.access.csv

@@ -1,7 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-event_quiz_access_event_user,event.quiz.access.event.user,model_event_quiz,event.group_event_user,1,0,0,0
-event_quiz_access_event_manager,event.quiz.access.event.manager,model_event_quiz,event.group_event_manager,1,1,1,1
-event_quiz_question_access_event_user,event.quiz.question.access.event.user,model_event_quiz_question,event.group_event_user,1,0,0,0
-event_quiz_question_access_event_manager,event.quiz.question.access.event.manager,model_event_quiz_question,event.group_event_manager,1,1,1,1
-event_quiz_answer_access_event_user,event.quiz.answer.event.user,model_event_quiz_answer,event.group_event_user,1,0,0,0
-event_quiz_answer_access_event_manager,event.quiz.answer.event.manager,model_event_quiz_answer,event.group_event_manager,1,1,1,1
+event_quiz_access_event_user,event.quiz.access.event.user,model_event_quiz,event.group_event_user,1,1,1,1
+event_quiz_question_access_event_user,event.quiz.question.access.event.user,model_event_quiz_question,event.group_event_user,1,1,1,1
+event_quiz_answer_access_event_user,event.quiz.answer.event.user,model_event_quiz_answer,event.group_event_user,1,1,1,1