diff --git a/web_access_rule_buttons/README.rst b/web_access_rule_buttons/README.rst new file mode 100644 index 00000000..303882d1 --- /dev/null +++ b/web_access_rule_buttons/README.rst @@ -0,0 +1 @@ +**This file is going to be generated by oca-gen-addon-readme.** \ No newline at end of file diff --git a/web_access_rule_buttons/__init__.py b/web_access_rule_buttons/__init__.py new file mode 100644 index 00000000..31660d6a --- /dev/null +++ b/web_access_rule_buttons/__init__.py @@ -0,0 +1,3 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import models diff --git a/web_access_rule_buttons/__manifest__.py b/web_access_rule_buttons/__manifest__.py new file mode 100644 index 00000000..291f999c --- /dev/null +++ b/web_access_rule_buttons/__manifest__.py @@ -0,0 +1,19 @@ +# Copyright 2016 Camptocamp SA +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +{ + "name": "Web Access Rules Buttons", + "summary": "Disable Edit button if access rules prevent this action", + "version": "11.0.1.0.0", + "author": "Camptocamp, Onestein, Odoo Community Association (OCA)", + "license": "AGPL-3", + "category": "Web", + "depends": [ + "web", + ], + "website": "https://github.com/OCA/web/tree/11.0/web_access_rule_buttons", + "data": [ + "views/web_access_rule_buttons.xml", + ], + "installable": True, +} diff --git a/web_access_rule_buttons/models/__init__.py b/web_access_rule_buttons/models/__init__.py new file mode 100644 index 00000000..31660d6a --- /dev/null +++ b/web_access_rule_buttons/models/__init__.py @@ -0,0 +1,3 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import models diff --git a/web_access_rule_buttons/models/models.py b/web_access_rule_buttons/models/models.py new file mode 100644 index 00000000..38dd9368 --- /dev/null +++ b/web_access_rule_buttons/models/models.py @@ -0,0 +1,37 @@ +# Copyright 2016 Camptocamp SA +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from odoo import models, api, exceptions + + +class Base(models.AbstractModel): + """ The base model, which is implicitly inherited by all models. """ + _inherit = 'base' + + @api.multi + def check_access_rule_all(self, operations=None): + """Verifies that the operation given by ``operations`` is allowed for + the user according to ir.rules. + + If ``operations`` is empty, it returns the result for all actions. + + :param operation: a list of ``read``, ``create``, ``write``, ``unlink`` + :return: {operation: access} (access is a boolean) + """ + if not operations or not any(operations): + operations = ['read', 'create', 'write', 'unlink'] + result = {} + for operation in operations: + if self.is_transient() or not self.ids: + # If we call check_access_rule() without id, it will try to + # run a SELECT without ID which will crash, so we just blindly + # allow the operations + result[operation] = True + continue + try: + self.check_access_rule(operation) + except exceptions.AccessError: + result[operation] = False + else: + result[operation] = True + return result diff --git a/web_access_rule_buttons/readme/CONTRIBUTORS.rst b/web_access_rule_buttons/readme/CONTRIBUTORS.rst new file mode 100644 index 00000000..37444b54 --- /dev/null +++ b/web_access_rule_buttons/readme/CONTRIBUTORS.rst @@ -0,0 +1,2 @@ +* Guewen Baconnier +* Antonio Esposito diff --git a/web_access_rule_buttons/readme/DESCRIPTION.rst b/web_access_rule_buttons/readme/DESCRIPTION.rst new file mode 100644 index 00000000..dd7a876d --- /dev/null +++ b/web_access_rule_buttons/readme/DESCRIPTION.rst @@ -0,0 +1,2 @@ +This addon disables the Edit button on the form views if the user +cannot edit the current record according to the record access rules. diff --git a/web_access_rule_buttons/readme/USAGE.rst b/web_access_rule_buttons/readme/USAGE.rst new file mode 100644 index 00000000..7a921d26 --- /dev/null +++ b/web_access_rule_buttons/readme/USAGE.rst @@ -0,0 +1,3 @@ +When using Odoo, even if a user has no rights to edit a record, the Edit button +is shown. The user can edit the record but won't be able to save his changes. +Now, the user won't be able to click on the Edit button. diff --git a/web_access_rule_buttons/static/src/js/form_controller.js b/web_access_rule_buttons/static/src/js/form_controller.js new file mode 100644 index 00000000..543023d2 --- /dev/null +++ b/web_access_rule_buttons/static/src/js/form_controller.js @@ -0,0 +1,32 @@ +/* Copyright 2016 Camptocamp SA + * License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). */ + +odoo.define("web_access_rule_buttons.main", function (require) { + "use strict"; + var FormController = require("web.FormController"); + FormController.include({ + + _update: function (state) { + return this._super(state).then(this.show_hide_buttons(state)); + }, + show_hide_buttons : function (state) { + var self = this; + return self._rpc({ + model: this.modelName, + method: 'check_access_rule_all', + args: [[state.data.id], ["write"]], + }).then(function (accesses) { + self.show_hide_edit_button(accesses.write); + }); + }, + show_hide_edit_button : function (access) { + if (this.$buttons) { + var button = this.$buttons.find(".o_form_button_edit"); + if (button) { + button.prop("disabled", !access); + } + } + }, + + }); +}); diff --git a/web_access_rule_buttons/tests/__init__.py b/web_access_rule_buttons/tests/__init__.py new file mode 100644 index 00000000..1c1376d5 --- /dev/null +++ b/web_access_rule_buttons/tests/__init__.py @@ -0,0 +1,3 @@ +# License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl.html). + +from . import test_access_rule_buttons diff --git a/web_access_rule_buttons/tests/test_access_rule_buttons.py b/web_access_rule_buttons/tests/test_access_rule_buttons.py new file mode 100644 index 00000000..47774b4d --- /dev/null +++ b/web_access_rule_buttons/tests/test_access_rule_buttons.py @@ -0,0 +1,19 @@ +# Copyright 2019 Onestein BV +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). +from odoo.tests.common import TransactionCase + + +class TestAccessRuleButtons(TransactionCase): + def setUp(self): + super(TestAccessRuleButtons, self).setUp() + + self.curr_obj = self.env['res.currency'] + self.curr_record = self.env.ref('base.USD') + + def test_check_access_rule_1(self): + res = self.curr_obj.check_access_rule_all(['write']) + self.assertTrue(res['write']) + + def test_check_access_rule_2(self): + res = self.curr_record.check_access_rule_all(['write']) + self.assertTrue(res['write']) diff --git a/web_access_rule_buttons/views/web_access_rule_buttons.xml b/web_access_rule_buttons/views/web_access_rule_buttons.xml new file mode 100644 index 00000000..dd3af871 --- /dev/null +++ b/web_access_rule_buttons/views/web_access_rule_buttons.xml @@ -0,0 +1,8 @@ + + + +