From 2f15a5fa647d55df36c9019df467802a3aa9b4e3 Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Fri, 4 May 2018 13:17:25 +0200
Subject: [IMP] base: Add support for private addresses

Purpose
=======

Add the possibility to create private addresses, only accessible for a subset
of users.

Specification
=============

- Add a new 'Private' partner type
- Add a res.groups in base 'Access to Private Addresses'
- Add ir.rules for the following behavior:
    - Every employees/internal users can read non-private addresses
    - Only users in group_private_addresses can access private addresses
- Add in base a simplified form view for private addresses
- A HR Officer is automatically granted in group_private_addresses
- Use the simplified form view to open the address_home_id form on employees
---
 odoo/addons/base/security/base_groups.xml   |  3 +++
 odoo/addons/base/security/base_security.xml | 31 +++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

(limited to 'odoo/addons/base/security')

diff --git a/odoo/addons/base/security/base_groups.xml b/odoo/addons/base/security/base_groups.xml
index 863046f9c4e..a7e32bb1065 100644
--- a/odoo/addons/base/security/base_groups.xml
+++ b/odoo/addons/base/security/base_groups.xml
@@ -49,6 +49,9 @@
             <field name="groups_id" eval="[(4,ref('base.group_partner_manager'))]"/>
         </record>
 
+        <record id="group_private_addresses" model="res.groups">
+            <field name="name">Access to Private Addresses</field>
+        </record>
         <!--
             A group dedicated to the portal users, making groups
             restrictions more convenient.
diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml
index 8d03802aadf..4eeac276f83 100644
--- a/odoo/addons/base/security/base_security.xml
+++ b/odoo/addons/base/security/base_security.xml
@@ -30,6 +30,37 @@
             <field name="perm_write" eval="False"/>
         </record>
 
+        <!-- Security restriction for private addresses -->
+        <record id="res_partner_rule_private_employee" model="ir.rule">
+            <field name="name">res.partner.rule.private.employee</field>
+            <field name="model_id" ref="base.model_res_partner"/>
+            <field name="domain_force">
+                [('type', '!=', 'private')]
+            </field>
+            <field name="groups" eval="[
+                (4, ref('base.group_user')),
+            ]"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+        <!-- Relex previous rule for group_private_addresses -->
+        <record id="res_partner_rule_private_group" model="ir.rule">
+            <field name="name">res.partner.rule.private.group</field>
+            <field name="model_id" ref="base.model_res_partner"/>
+            <field name="domain_force">
+                [('type', '=', 'private')]
+            </field>
+            <field name="groups" eval="[
+                (4, ref('base.group_private_addresses'))
+            ]"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+
         <record model="ir.rule" id="ir_default_user_rule">
             <field name="name">Defaults: alter personal defaults</field>
             <field name="model_id" ref="model_ir_default"/>
-- 
cgit v1.2.3