- Use the one defined in the account module allowing paying multiple journal entries and group payments together. - Remove the hr_expense_check module that contains only duplicated features regarding the register payment wizard. --task: 2273528
1. Apply same logic for sale and purchase user. 2. The group Expense Team Approuver can write/create/unlink, it is opposite than https://github.com/odoo/odoo/blob/13.0/addons/hr_expense/security/ir.model.access.csv#L15 and https://github.com/odoo/odoo/blob/13.0/addons/hr_expense/security/ir.model.access.csv#L16 opw:2275116 closes odoo/odoo#53405 Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
closes odoo/odoo#53834 Taskid: 2229597 X-original-commit: cc125a1fe850941a7bf1cec2cd0392fdf025a60a Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
In the same xml file (meaning one of the two rule is useless, or wrong if giving less rights than the other). Removing rules that had no impact will ease the understanding of security problems, by reducing the number of interconnecting rules.
ir.rule are default values but can be customized based on the company's policy and needs. This is typically a record that is in noupdate as should be customization-friendly.
Purpose ======= The current kanban view is messy. It is difficult to identify which apps are installed or not. The user can completely miss a module that might have interested him. A search panel would make things way more readable. closes odoo/odoo#44401 Taskid: 2181557 Related: odoo/enterprise#8144 Related: odoo/upgrade#879 Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value
account*: use account.group_account_user for all transient by default
remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
additional verifications are made to ensure they are executed
only on the documents the user has access to you
give portal access to mail.compose.message as portal still does
some actions like posting messages on the forum
add ir.rule to avoid reading somebody else messages
increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
partner manager for actions linked to partners
avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
event user inherit from sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
manager can set a plan according to group on button
anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
as the source is an account.move
keep the payment.acquirer.onboarding.wizard to system user
only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation
base: base.language.*: allow employee (cf lang_install)
change.password.user: can not read change password wizard of
other users
test.*: no access is needed
Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl
This commit merges the following models * account.invoice and account.move * account.invoice.line and account.move.line * account.voucher and account.move * account.voucher.line and account.move.line It was the opportunity for a big cleanup of the code, so it also restructures the whole account module, its different models/fields, the tests etc. for a better world and a better code readability. ==== Rationale ==== The rationale of this huge change is that we want journal entries / invoices to be easily edited, and changes reflected in the other model. It's a HUGE feature and very strategic for the fiduciary companies. For example, changing the account of a journal entry needs to be automatically reflected on the related invoice. The same reasoning applies to sale/purchase vouchers. ==== Changes made in features ===== When creating an invoice, you are now creating a journal entry directly. --> The object account.invoice no longer exists. In the same fashion when creating an invoice line, you're now adding journal items directly in the journal entry representing the invoice. If this invoice line has some tax, it may create additional journal items as well. --> The models account.invoice.line & account.invoice.tax no longer exist Identically, when creating a sale/purchase receipt with its lines, you are now creating a journal entry directly and there's no more usability difference between encoding a receipt or an invoice. --> The object account.voucher no longer exists. --> The object account.voucher.line no longer exists. --> The whole account_voucher module no longer exists. Positive side-effects coming from these changes are * draft invoices/bills/sale or purchase receipts now create a draft accounting entry. Validate these objects now simply post its journal entry. That means that draft invoices/bills/sale or purchase receipt can straightforwardly be included in reporting or budgets. * opening a journal entry in form view will now always open the correct view: if it's a sale/purchase journal entry we will have a customer invoice/vendor bill view or a sale/purchase receipt view, whatever the menu we're coming from. * code & business logic simplification. It is also condensed in a single place instead of being partially duplicated on invoices, vouchers and journal entries. There should be no feature loss, except the one allowing to group multiple journal items together based on the same product during the invoice validation. ==== Changes made in models ===== * account.invoice: model removed. Instead, now use account.move with following mapping field (account.invoice) field (account.move) ----------------------- -------------------- name invoice_payment_ref number name reference ref comment narration user_id invoice_user_id amount_ total_company_signed amount_total_signed residual amount_residual state state + invoice_payment_state /!\ selection changed date_invoice invoice_date date_due invoice_date_due sent invoice_sent origin invoice_origin payment_term_id invoice_payment_term_id partner_bank_id invoice_partner_bank_id incoterm_id invoice_incoterm_id vendor_bill_id invoice_vendor_bill_id source_email invoice_source_email vendor_display_name invoice_vendor_display_name invoice_icon invoice_vendor_icon cash_rounding_id invoice_cash_rounding_id sequence_number_next invoice_sequence_number_next sequence_number_next_prefix invoice_sequence_number_next_prefix 'invoices' subset of account.move can be accessed by using the selection field 'type' or one of the many helpers like is_invoice() * account.move: now has a valid state 'cancel' that has to be excluded from all business logic * account.move: field 'amount' renamed into 'amount_total' * account.move: field 'reverse_entry_id' renamed into 'reversed_entry_id' * account.move.line: now has a field 'display_type' that has to be excluded from all business logic, in order to support invoice layouting * account.invoice.line: model removed. Instead, now use account.move.line with following mapping field (account.invoice.line) field (account.move.line) ---------------------------- ------------------------- invoice_id move_id uom_id product_uom_id invoice_line_tax_ids tax_ids account_analytic_id analytic_account_id 'invoice lines' subset of all account.move.line from a journal entry can be accessed by using the boolean field 'exclude_from_invoice_tab' * account.invoice.tax: model removed. Instead, now use account.move.line with following mapping field (account.invoice.tax) field (account.move.line) --------------------------- ------------------------- invoice_id move_id account_analytic_id analytic_account_id amount price_unit base tax_base_amount 'tax lines' subset of all account.move.line from a journal entry can be accessed by using the relational field 'tax_line_id' * account.invoice.confirm: model removed. Instead, now use the 'post()' function of account.move * account.invoice.refund: model removed. Instead, now use account.move.reversal to reverse the entries with the same options as we had for invoices * account.voucher: model removed. Instead, now use account.move of type in ['out_receipt', 'in_receipt] * account.voucher.line: model removed. Instead, now use account.move.line ==== Changes made in functions ==== * on account.move, method _run_post_draft_to_post() renamed into _autopost_draft_entries() * on account.move, method action_account_invoice_payment() renamed into action_invoice_register_payment() * on account.move, method action_invoice_reconcile_to_check() renamed into action_open_matching_suspense_moves() * on account.move, method _get_domain_edition_mode_available() renamed into _get_domain_matching_supsense_moves() * on account.move, method _get_intrastat_country_id() renamed into _get_invoice_intrastat_country_id() * on account.move.line, method _get_domain_for_edition_mode() renamed into _get_suspense_moves_domain() * in account.bank.statement, contextual key 'edition_mode' renamed into 'suspense_moves_mode' Was task 1917430
Purpose
=======
Allow the user to select the allowed companies for which he wants to see records
on top of selecting his current company.
It is confusing for users to see the records from the company he is connected to
and the records of the children companies.
Instead of using the hierarchy of companies to access records across companies,
the user can now select (from his set of allowed companies) the companies for
which he wants to access records.
/!\ This means that the user will interact with records from company A when in
company B.
Example: a SO has been created and confirmed in A. When in B, I create the
invoice from it.
Specifications
==============
1/ Deprecate the parent/children hierarchy on the res.company model. The fields are
kept on the res.company model to ensure the retro-compatibility, but won't be used
accross the standard code anymore. The only functional usage for this mechanism
was to allow to see records from several companies by creating a virtual parent
company, which will be possible with the new mechanism.
2/ By default, a user will only see the records of the company he is connected
to (or records without a company). (It is still editable by the user if needed).
For that, put this information in the user context, to allow having different
configurations on different browser tabs. Instead of having domains like
['|',
('company_id', '=', False),
('company_id', 'child_of', user.company_id.id)]
you'll have something like
['|',
('company_id', '=', False),
('company_id', 'in', company_ids)]
Note that the 'company_ids' is a value that is passed in the evaluation
context on the record rule, as we already have user, or time.
company_ids is a list of the ids of all the enabled companies in the
user's context.
3/ Out of the generic improvements brought by this task, this will illustrate
issues that could exist since several versions. For example, it should not be
possible to create a scrap order for the company A with a package of the company
B, or it should not be possible to create an invoice on the company A with
payment terms from the company B. Before the version 12.0, it was easy to
encounter this kind of issues as the admin was the SUPERUSER_ID. A positive side
effect of the fact that the SUPERUSER_ID has become an inactive user was to
make it more difficult to introduce mismatch on the records, but haven't solved
the issue, as it was still possible to do it with parent companies
configuration. Some of these issues have been fixed in this commit, but all the
business flows should be re-tested to check if an ir.rule should be introduced
(eg: a multi company rule for stock.quand.package), if the company of a record
is correctly transfered to another record created from the first record (eg:
From a SO, create an invoice and a payment, the company of the sales order
should be transfered on the invoice and the payment, even if the company of the
sales order is A and I'm logged into the company B with the company A enabled.
4/ Currently, if I click on a button on a notification email (example 'View
Task'), I face a traceback if I'm not logged into the company of the record.
Now, if you click on a button and if you have access to the record, the correct
company will be automatically set.
5/ If I display a kanban view with several records from several companies (and
an image), all the images should be displayed.
6/ Currently if you copy paste an url, this will crash if you're not in the
correct company. This won't be fixed because it's quite impossible to do it in
a clean way. This task brings a workaround. Copy/Paste -> Traceback -> Log into
the correct company, re-copy/paste -> Ok.
7/ 2 property methods have been added on the environment to retrieve the company
on which the user is logged in and the companies the user enabled, on a specific
tab.
That way, when creating a record, instead of doing
default=lambda self: self.env.user.company_id
do
default=lambda self: self.env.company_id
On the other hand, to retrieve the enabled companies, do
companies = self.env.company_ids
8/ Modify the Company Switcher widget to allow to log into another company
WITHOUT writing on the res.users (and thus bringing cache invalidation issues
and so on). Also allow to enable several companies and see records from several
companies, and independantly of the other browser's tabs.
9/ When focusing on a tab, save the current company configuration on the local
storage. That way, when doing 'CTRL+T' or a middle click, the context is
propagated to the new tab.
10/ Improve the error message in case of multi company access errors. Now, when
the user is in debug mode, display the related names of the records and the name
of the user who brings the issue.
11/ Remove the context erasing when writing on a res.users
This is probably coming from the migration to new API of the base module.
The context was not propagated at this moment, which was a common mistake at
that time. When migrating the module, probably by using the 'black box' method,
as the context was not propagated, it was erased on the new version. This is
now an issue because the context (i.e. the enabled companies) was erased when
writing on a res.users, leading to tracebacks.
See: https://github.com/odoo/odoo/commit/7eab8e26d3d46c53f4be924d6a34e80a66e74960#diff-4c2e738ee8f64f11806c889ea097b5e7R624
12/ Fix the crash manager on redirect warnings. The issue is the following
- Create an invoice on a company without a configured CoA.
- Set a partner
- On the onchange_partner_id, a redirect warning is raised to propose you
to configure a CoA
- Click on 'Go to the configuration panel'
- A generic warning says something like 'Do you want to discard your changes?'
- Click on yes, the page refreshes, but not on the redirect action.
Now, set correctly the action on the hash, and reload instead. The breadcrumb is
lost for example, but you reach the correct action at least.
13/ Introduce a res.group to enable/disable the multi company per tab
feature.
14/ To help the users to know which tab is in which company, add the
possibility to have a favicon per company. When creating a company,
the classical 'O' icon is colored by default in a random color.
15/ Remove the company switcher on the frontend. This was mainly there
to allow a user to swicth to the company linked to the website.
This behavior is now transparent to the user. If the website A is
activated, then the company set on the context is the company of the
website.
16/ Deprecated the _company_default_get method on the res.company
model. Remove the method _get_company on the res.users model.
17/ Add 'allowed_company_ids' and 'current_company_id' on the pyeval
context. You can now use those variables on domains in the views to
access directly to the activated company.ies on the current tab.
TaskID: 1960971
closes odoo/odoo#32341
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Purpose ======= Access group terminology is missleading. Yous have to be manager to administrate an application. This task consists to rename groups to be understandable for everyone. Groups should be reorganised on the users form to be more explicit. Specification ============= 1/ Rename 'Manager' to 'Administrator' in users groups. 2/ Define a hierarchy on access groups by using the category_id in the manifests A category 'Operations/Project' will create a category Project with a parent category 'Operations', and something smart is already developed (in modules/db.py) to avoid duplicating categories. 3/ Add a group in expenses to be able to approve expenses reports for my team. 4/ Add a group in timesheets to be able to approve timesheets for my team. 5/ Remove partially the useless crap in ir_module_category_data.xml 6/ Sort access rights groups on users form according to its parent category closes odoo/odoo#29362 Signed-off-by: "Yannick Tivisse (yti)" <yti@odoo.com>