Before this commit, several token related data were stored on the res_users table. During event sync, the table could be locked and this commit aims to move these data to a dedicated table to avoid bottleneck effets.
Taskid: 2484335
Part-of: odoo/odoo#68700
No need to keep it, it's useless and can confuse translators
closesodoo/odoo#74782closesodoo/odoo#74832
X-original-commit: 40c74e686f23c10e35000be583716d0c093ce3b3
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
The license is missing in most enterprise manifest so
the decision was taken to make it explicit in all cases.
When not defined, a warning will be triggered starting from
14.0 when falling back on the default LGPL-3.
closesodoo/odoo#74245
Related: odoo/design-themes#48
Related: odoo/enterprise#19862
Signed-off-by: Xavier Dollé (xdo) <xdo@odoo.com>
This branch adds request.redirect on all requests.
In case of a front end request, we do an url_for to the location.
We removed redirect_with_hash that was only for retro compatibility
local_redirect has been renamed to redirect_query, and param keep_hash has been
removed and moved.
Default code for redirect is 303 now instead of 302.
Now redirect and redirect_query make local redirect by default, you need to
pass local=False to make external redirect.
All werkeug.utils.redirect has been replaced by request.redirect.
Http.redirect now use an http.Response type, and it become easy to add an
override like 'set_cookies' e.g.
Dispatch of a website.page return an http.response too, so we first need to
check if it is a cached version before to check if it is an Odoo Response.
Migrate your code:
http.redirect -> request.redirect(location, code, local)
http.local_redirect -> request.redirect_query(location, query, code, local)
http.redirect_with_hash -> request.redirect
Courtesy of odony for help and review ;)
closesodoo/odoo#72599
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Each time the calendar view of event.calendar is loaded,
the synchronization with google calendar was launched
and if a user open many tabs, it can lead to deadlock
Solution: Check for lock before launching the synchro,
if the transaction cannot acquire the lock, it's proably
because another synchro already started
closesodoo/odoo#69540
X-original-commit: 101598fae6fc32a49bb6d422a82b621a81201cb5
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Issue
-----
- Currently the cron can take too much time and timeout.
In case of timeout process data are rollback.
The sync per user also crash and stop the process for all user and make
the transaction rollback
In both case we cannot ensure that all user will end up synchronized
- The real time sync can end up in deadlock:
If you create a holiday, it trigger a write on the user and the
creation of an event that will be synchronize with google
The synchronization may ask for a new token if this request fail
a new cursor is create to empty on the user the refresh token.
2 cursor that are trying to write on the same record => Deadlock
- Bad refresh token management
When the refresh token is not anymore valid it's erased but
the calendar_token and validity are kept. Is odoo consider
the token valid it will try to sync an event with google|microsoft
despite the refresh token is not valid anymore. Of course this lead to
an error and the impossibility to create an event anymore without
manually wiping the calendar_token and calendar_token_validity
- Error 401 are handled in context manager
(google|microsoft)_calendar_token, but get_*_calendar_token never raise
http error only user error.
Solution
---------
- Improve cron resilience
- Commit between each user and rollback in case of issue for a user
- Solve the issue when stop < start
- Solve issue with rrule not being the first element in the list
of recurrence
- Improve perf when searching for organizer
- In order to limit the volume during the first synchronization, we only
synchronized event from x days in the past to x days in the future with
x = 365 by default
- Limit the number of event to synchronize to google each time to 200,
since this operation is time consuming (1 request is sent per event)
- Avoid deadlock
A new cursor is not needed, we only need to ensure that write on the
user is done with a clean cursor and will be commited despite the error
raise. So rollabck before the write and commit explicitly afterwards
- Erase properly all the token and the token validity if the refresh token is not valid anymore
- For google calendar, erase also the token in case of 401
error: Wrong client id, this mean the database parameter have been
change and all the user should reconfigure the synchronization
- Directly handle error 401 with error 400 in refresh_token method
closesodoo/odoo#66250
X-original-commit: 486f69abad6226e5ce016ad89a0eeb103d709a3f
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
This commit refactors calendar synchronization between Odoo and Google after the
main calendar application refactoring.
This refactoring takes advantage of two new features from the Google API:
- New way of synchronizing resources efficiently[1]
Incremental sync is performed repeatedly and updates Odoo with all the changes that
happened ever since the previous sync. Each time, Odoo provides the previous sync
token it obtained from Google and stores the new sync token from the response.
- Event metadata[2]
Ability to set hidden key-value pairs with an event, called extended properties.
These extended properties are used to store the related odoo event id and the Odoo
owner id (see known limitations)
Known limitations
=================
- Let A and B be two new users (no tokens available). A creates an event in Odoo and
invites B. A is the owner of the event (user_id). Now B authenticates to his Google Calendar
account and synchronizes his calendar. We cannot send the event to A's calendar since we
don't have any access to his Google Calendar. Hence the event his sent to B's calendar.
This leads to data de-synchronisation: The owner is A in Odoo but B in Google.
The "real" owner (user A) is stored in the Google event's metadata to be able to
reconcile the owner for following synchronizations.
- Let A and B be two users of Odoo and Google Calendar. And let the Google Calendar of B
be private (e.g. if A creates an event in Google Calendar and invites B, B won't see the
event in his calendar). If A creates an event in Odoo and invites B. The event is synced
to Google Calendar of A. Now B can see the event in Odoo but he can't see it in his
Google Calendar.
Task 2126717
PR #42031
PR Enterprise odoo/enterprise#8006
[1] https://developers.google.com/calendar/v3/sync
[2] https://developers.google.com/calendar/extended-properties
Purpose
=======
The current kanban view is messy. It is difficult to identify which
apps are installed or not. The user can completely miss a module
that might have interested him. A search panel would make things way
more readable.
closesodoo/odoo#44401
Taskid: 2181557
Related: odoo/enterprise#8144
Related: odoo/upgrade#879
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value
account*: use account.group_account_user for all transient by default
remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
additional verifications are made to ensure they are executed
only on the documents the user has access to you
give portal access to mail.compose.message as portal still does
some actions like posting messages on the forum
add ir.rule to avoid reading somebody else messages
increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
partner manager for actions linked to partners
avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
event user inherit from sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
manager can set a plan according to group on button
anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
as the source is an account.move
keep the payment.acquirer.onboarding.wizard to system user
only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation
base: base.language.*: allow employee (cf lang_install)
change.password.user: can not read change password wizard of
other users
test.*: no access is needed
Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
Before this fix, when a refresh of the google token was triggered
and error 400 where returned, if the user did not have write rights
on res_users, an access rights was raised
Now, the write is done and the real error is raised for the client.
Part of OPW-2123045 (needed to further investigations)
closesodoo/odoo#41777
X-original-commit: b4f794c55bdfbf2a5482b7ee30780fdef8d4978f
Signed-off-by: Richard Mathot (rim) <rim@openerp.com>
Followup of a425695e
The terms were back in 12.0
Courtesy of Juan José Scarafía
closesodoo/odoo#41624
X-original-commit: 85d0c7001a997748d7691205bbb8d066597591a5
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
In an attempt to ease the error reporting, some Google Error were raised
as UserError so they are shown on screen and the user can take immediate
action when the error is their side.
As shown by the different commits bellow, the introduced changes had
some bad side effects. Empty request body, empty response body, non-json
response. The resulting code got complicated.
Apart from the Google API itself, some Odoo module (i.e.
google_calendar) excepted HTTPErrors on some endpoints that are now
raised as incompatible UserErrors. There are no straightforward
solutions for those endpoints.
This commit reverts:
- da13c704
- 9c369a44
- 85ab9238
opw-2000950
closesodoo/odoo#34532
Signed-off-by: Richard Mathot (rim) <rim@openerp.com>
There is no guaranty that both the request body and the response body
will contain JSON data. This fix corrects the logging by printing the
raw text in case of json decode error.
opw-2006561
opw-2024242
closesodoo/odoo#34221
Signed-off-by: Julien Castiaux <Julien00859@users.noreply.github.com>
Configure google to be synchronized with Odoo, create a contact with a
wrong email address (I used `foo@.test.`), create an event in the
calendar, add the contact as attendee, sync with google. Traceback.
The traceback is a `request.exception.HTTPError` reraise by
`_do_request` in the `google.service` model on several HTTP errors, 400
amoung them. The real error is "Invalid attendee email." but the
information is lost in the error message.
The error hanlding has been rethink so it raise a user friendly error
via the UserError modal with just the error message sent by the Google
API. The logged error has been rethink to pretty print both the request
and the response.
opw-1974295
closesodoo/odoo#33058
Signed-off-by: Lucas Perais (lpe) <lpe@odoo.com>
Include the Google Error message in the error message showed on screen.
Fine tuning of da13c70484 : missing transiflex translations, empty body,
wrong string format.
opw-1966309
closesodoo/odoo#33216
Signed-off-by: Lucas Perais (lpe) <lpe@odoo.com>
Arnaud Joset