Yannick Tivisse
1ecba213f4
Coming from a bug in web_settings_dashboard. Invited user didn't have any rights when created from the dashboard, which was leading to an error. This bug leaded to a new discussion. Better to have basic employee having user rights for all main applications. For bigger entreprises there is an admin that will carefully remove extra rights, if necessary. The target is small businesses, it makes sense that every way to create a user gives the same result. In conclusion, each new user has a full access to the applications by default How is it implemented ? We added an inactive default user which original access right to the groups 'base.group_user' and 'base.group_partner_manager' in base. Each application will extend the default user's access right by adding the maximal access right for this application. On user creation, we will use by default the 'group_id' field from the default user. We will in the same time remove the ugly 'default_groups_ref' key which was passed sometimes in the context for some fields in some views, and sometimes nothing. So, the user can modify the access rights for the default user, but he should be aware that removing project user access rights for a default user will prevent a *created on the fly in a task* user will not be able to access the task.
143 lines
6.5 KiB
XML
143 lines
6.5 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<openerp>
|
|
<data noupdate="0">
|
|
|
|
<record id="group_project_user" model="res.groups">
|
|
<field name="name">User</field>
|
|
<field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
|
|
<field name="category_id" ref="base.module_category_project_management"/>
|
|
</record>
|
|
|
|
<record id="group_project_manager" model="res.groups">
|
|
<field name="name">Manager</field>
|
|
<field name="category_id" ref="base.module_category_project_management"/>
|
|
<field name="implied_ids" eval="[(4, ref('group_project_user'))]"/>
|
|
<field name="users" eval="[(4, ref('base.user_root'))]"/>
|
|
</record>
|
|
|
|
<record id="base.default_user" model="res.users">
|
|
<field name="groups_id" eval="[(4,ref('project.group_project_manager'))]"/>
|
|
</record>
|
|
|
|
<record id="group_tasks_work_on_tasks" model="res.groups">
|
|
<field name="name">Task's Work on Tasks</field>
|
|
<field name="category_id" ref="base.module_category_hidden"/>
|
|
</record>
|
|
|
|
<record id="group_time_work_estimation_tasks" model="res.groups">
|
|
<field name="name">Time Estimation on Tasks</field>
|
|
<field name="implied_ids" eval="[(4, ref('group_tasks_work_on_tasks'))]"/>
|
|
<field name="category_id" ref="base.module_category_hidden"/>
|
|
</record>
|
|
|
|
</data>
|
|
<data noupdate="1">
|
|
|
|
<record model="ir.rule" id="project_comp_rule">
|
|
<field name="name">Project: multi-company</field>
|
|
<field name="model_id" ref="model_project_project"/>
|
|
<field name="global" eval="True"/>
|
|
<field name="domain_force">['|',
|
|
('company_id', '=', False),
|
|
('company_id', 'child_of', [user.company_id.id]),
|
|
]</field>
|
|
</record>
|
|
|
|
<record model="ir.rule" id="project_project_manager_rule">
|
|
<field name="name">Project: project manager: see all</field>
|
|
<field name="model_id" ref="model_project_project"/>
|
|
<field name="domain_force">[(1, '=', 1)]</field>
|
|
<field name="groups" eval="[(4,ref('project.group_project_manager'))]"/>
|
|
</record>
|
|
|
|
<record model="ir.rule" id="project_public_members_rule">
|
|
<field name="name">Project: employees: portal, employees or followers</field>
|
|
<field name="model_id" ref="model_project_project"/>
|
|
<field name="domain_force">['|',
|
|
('privacy_visibility', 'in', ['portal', 'employees']),
|
|
('message_partner_ids', 'in', [user.partner_id.id])
|
|
]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_user'))]"/>
|
|
</record>
|
|
|
|
<record model="ir.rule" id="task_comp_rule">
|
|
<field name="name">Project/Task: multi-company</field>
|
|
<field name="model_id" ref="model_project_task"/>
|
|
<field name="global" eval="True"/>
|
|
<field name="domain_force">['|',
|
|
('company_id', '=', False),
|
|
('company_id', 'child_of', [user.company_id.id]),
|
|
]</field>
|
|
</record>
|
|
|
|
<record model="ir.rule" id="task_visibility_rule">
|
|
<field name="name">Project/Task: employees: portal or employee or (followers and following)</field>
|
|
<field name="model_id" ref="model_project_task"/>
|
|
<field name="domain_force">[
|
|
'|',
|
|
('project_id.privacy_visibility', 'in', ['portal', 'employees']),
|
|
'|',
|
|
'&',
|
|
('project_id.privacy_visibility', '=', 'followers'),
|
|
('project_id.message_partner_ids', 'in', [user.partner_id.id]),
|
|
'|',
|
|
('message_partner_ids', 'in', [user.partner_id.id]),
|
|
# to subscribe check access to the record, follower is not enough at creation
|
|
('user_id', '=', user.id)
|
|
]</field>
|
|
<field name="groups" eval="[(4,ref('base.group_user'))]"/>
|
|
</record>
|
|
|
|
<record model="ir.rule" id="project_manager_all_project_tasks_rule">
|
|
<field name="name">Project/Task: project manager: see all</field>
|
|
<field name="model_id" ref="model_project_task"/>
|
|
<field name="domain_force">[(1, '=', 1)]</field>
|
|
<field name="groups" eval="[(4,ref('project.group_project_manager'))]"/>
|
|
</record>
|
|
|
|
<!-- Portal -->
|
|
<record model="ir.rule" id="portal_project_rule">
|
|
<field name="name">Project: portal users: portal or following</field>
|
|
<field name="model_id" ref="project.model_project_project"/>
|
|
<field name="domain_force">[
|
|
'|',
|
|
'&',
|
|
('privacy_visibility', '=', 'portal'),
|
|
('message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
|
|
'&',
|
|
('privacy_visibility', '=', 'followers'),
|
|
('message_partner_ids', 'in', [user.partner_id.id])
|
|
]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_portal'))]"/>
|
|
</record>
|
|
|
|
<record model="ir.rule" id="portal_task_rule">
|
|
<field name="name">Project/Task: portal users: (portal and colleagues following) or (followers and following)</field>
|
|
<field name="model_id" ref="project.model_project_task"/>
|
|
<field name="domain_force">[
|
|
'|',
|
|
'|',
|
|
'&',
|
|
('project_id.privacy_visibility', '=', 'portal'),
|
|
('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
|
|
'&',
|
|
('project_id.privacy_visibility', '=', 'followers'),
|
|
('project_id.message_partner_ids', 'in', [user.partner_id.id]),
|
|
'&',
|
|
# on employee project can receive messages but not access the object
|
|
('project_id.privacy_visibility', '!=', 'employees'),
|
|
('message_partner_ids', 'in', [user.partner_id.id])
|
|
]</field>
|
|
<field name="groups" eval="[(4, ref('base.group_portal'))]"/>
|
|
</record>
|
|
|
|
<record model="ir.rule" id="report_project_task_user_report_comp_rule">
|
|
<field name="name">Task Analysis multi-company</field>
|
|
<field name="model_id" ref="model_report_project_task_user"/>
|
|
<field name="global" eval="True"/>
|
|
<field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
|
|
</record>
|
|
|
|
</data>
|
|
</openerp>
|