Odoo Server (MOVED TO GITHUB)

Merge lp:~openerp-dev/openobject-server/trunk-ui-access-rga into lp:openobject-server

  1. trunk-ui-access-rga
  2. Merge into trunk
Proposed by Harry (OpenERP)
Status: Needs review
Proposed branch: lp:~openerp-dev/openobject-server/trunk-ui-access-rga
Merge into: lp:openobject-server
Diff against target: 125 lines (+61/-1)
3 files modified
openerp/addons/base/ir/ir_ui_view.py (+5/-0)
openerp/addons/base/rng/view.rng (+2/-0)
openerp/addons/base/tests/test_acl.py (+54/-1)
To merge this branch: bzr merge lp:~openerp-dev/openobject-server/trunk-ui-access-rga
Reviewer Review Type Date Requested Status
OpenERP Core Team Pending
Review via email: mp+217226@code.launchpad.net
To post a comment you must log in.

Unmerged revisions

5023. By Ravi Gadhia (OpenERP)

[IMP] add flage 'can_create and 'can_write' in from view m2o field node soclient parse it according display create and create on popup autocomple list of m2o field

5022. By Ravi Gadhia (OpenERP)

[FIX] wrong resolve on previous merge

5021. By Ravi Gadhia (OpenERP)

Merge with trunk

5020. By RGA(OpenERP)

[IMP] for many2one and many2many field add 'can_create' and 'can_write' flage on field node based on it's relation model access right, and change field ui options based on those option ==>lp:~openerp-dev/openerp-web/trunk-ui-access-rga

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1=== modified file 'openerp/addons/base/ir/ir_ui_view.py'
2--- openerp/addons/base/ir/ir_ui_view.py 2014-04-22 14:46:51 +0000
3+++ openerp/addons/base/ir/ir_ui_view.py 2014-04-25 12:36:52 +0000
4@@ -554,6 +554,7 @@
5 fields = xfields
6 if node.get('name'):
7 attrs = {}
8+ relation = None
9 try:
10 if node.get('name') in Model._columns:
11 column = Model._columns[node.get('name')]
12@@ -563,6 +564,7 @@
13 column = False
14
15 if column:
16+ relation = self.pool.get(column._obj)
17 children = False
18 views = {}
19 for f in node:
20@@ -580,6 +582,9 @@
21
22 field = model_fields.get(node.get('name'))
23 if field:
24+ if relation and field['type'] in ('many2one', 'many2many'):
25+ for method in ['create', 'write']:
26+ node.set('can_'+method, "%s" % relation.check_access_rights(cr, user, method, raise_exception=False))
27 orm.transfer_field_to_modifiers(field, modifiers)
28
29 elif node.tag in ('form', 'tree'):
30
31=== modified file 'openerp/addons/base/rng/view.rng'
32--- openerp/addons/base/rng/view.rng 2014-01-24 08:43:19 +0000
33+++ openerp/addons/base/rng/view.rng 2014-04-25 12:36:52 +0000
34@@ -590,6 +590,8 @@
35 <rng:optional><rng:attribute name="filters"/></rng:optional>
36 <rng:optional><rng:attribute name="statusbar_visible"/></rng:optional>
37 <rng:optional><rng:attribute name="statusbar_colors"/></rng:optional>
38+ <rng:optional><rng:attribute name="can_create" /></rng:optional>
39+ <rng:optional><rng:attribute name="can_write" /></rng:optional>
40 <rng:optional><rng:attribute name="interval" /></rng:optional>
41 <!-- Widget *static* options defined as an arbitrary JSON dict, with
42 widget-dependent parameters. To be ignored if widget/client does
43
44=== modified file 'openerp/addons/base/tests/test_acl.py'
45--- openerp/addons/base/tests/test_acl.py 2014-02-09 00:37:45 +0000
46+++ openerp/addons/base/tests/test_acl.py 2014-04-25 12:36:52 +0000
47@@ -7,7 +7,8 @@
48
49 # test group that demo user should not have
50 GROUP_TECHNICAL_FEATURES = 'base.group_no_one'
51-
52+GROUP_ERP_MANAGER = 'base.group_erp_manager'
53+GROUP_SYSTEM = 'base.group_system'
54
55 class TestACL(common.TransactionCase):
56
57@@ -16,9 +17,15 @@
58 self.res_currency = self.registry('res.currency')
59 self.res_partner = self.registry('res.partner')
60 self.res_users = self.registry('res.users')
61+ self.res_company = self.registry('res.company')
62 _, self.demo_uid = self.registry('ir.model.data').get_object_reference(self.cr, self.uid, 'base', 'user_demo')
63 self.tech_group = self.registry('ir.model.data').get_object(self.cr, self.uid,
64 *(GROUP_TECHNICAL_FEATURES.split('.')))
65+ self.erp_manager_group = self.registry('ir.model.data').get_object(self.cr, self.uid,
66+ *(GROUP_ERP_MANAGER.split('.')))
67+
68+ self.erp_system_group = self.registry('ir.model.data').get_object(self.cr, self.uid,
69+ *(GROUP_SYSTEM.split('.')))
70
71 def test_field_visibility_restriction(self):
72 """Check that model-level ``groups`` parameter effectively restricts access to that
73@@ -102,6 +109,52 @@
74 self.assertEqual(cm.exception.args[0], 'Access Denied')
75 finally:
76 self.res_partner._columns['email'].groups = False
77+
78+ def test_view_create_edit_button_visibility(self):
79+ """Test form view Create, Edit, Delete button visibility based on access right of model"""
80+ methods = ['create', 'edit', 'delete']
81+
82+ # For demo user check Create Edit and Delete button visibility as restricted group user
83+ company_view = self.res_company.fields_view_get(self.cr, self.demo_uid, False, 'form')
84+ view_arch = etree.fromstring(company_view['arch'])
85+ for method in methods:
86+ self.assertEqual(view_arch.get(method), 'false', "for `demo` user form view %s button should not visibile" % (method.capitalize()))
87+
88+ # Make demo user a member of the group_erp_manager(Access Rights) group and check button visibility
89+ self.erp_manager_group.write({'users': [(4, self.demo_uid)]})
90+ company_view = self.res_company.fields_view_get(self.cr, self.demo_uid, False, 'form')
91+ view_arch = etree.fromstring(company_view['arch'])
92+ for method in methods:
93+ self.assertIsNone(view_arch.get(method), "for `demo` user form view %s button should visibile" % (method.capitalize()))
94+
95+ #cleanup
96+ self.erp_manager_group.write({'users': [(3, self.demo_uid)]})
97+
98+ def test_m2o_field_create_edit_visibility(self):
99+ """Test many2one field Create and Edit option visibility based on access rights of relation field"""
100+ methods = ['create', 'write']
101+
102+ # For demo user check create & edit option visibility of many2one field as restricted group user
103+ company_view = self.res_company.fields_view_get(self.cr, self.demo_uid, False, 'form')
104+ view_arch = etree.fromstring(company_view['arch'])
105+ field_node = view_arch.xpath("//field[@name='currency_id']")
106+ self.assertTrue(len(field_node), "currency_id field should be in company from view")
107+ currency_node = field_node[0]
108+ for method in methods:
109+ self.assertEqual(currency_node.get('can_'+method), 'False', "for 'demo' user, company form view currency_id m2o field should not display Create & Edit.. option")
110+
111+ # Make demo user a member of the system_group(Settings) group and check create & edit option visibility
112+ self.erp_system_group.write({'users': [(4, self.demo_uid)]})
113+ company_view = self.res_company.fields_view_get(self.cr, self.demo_uid, False, 'form')
114+ view_arch = etree.fromstring(company_view['arch'])
115+ field_node = view_arch.xpath("//field[@name='currency_id']")
116+ self.assertTrue(len(field_node), "currency_id field should be in company from view")
117+ currency_node = field_node[0]
118+ for method in methods:
119+ self.assertEqual(currency_node.get('can_'+method), '1', "for 'demo' user, company form view currency_id m2o field should display Create & Edit.. option")
120+
121+ #cleanup
122+ self.erp_system_group.write({'users': [(3, self.demo_uid)]})
123
124 if __name__ == '__main__':
125 unittest2.main()