ruodoo-public/public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Public release from ruodoo-project: 19.0 - 2026-11-01 22:52:25 UTC

Browse Source
This commit is contained in:
CI Publish Bot
2026-11-01 22:54:30 +00:00
commit 26250aa580
2492 changed files with 664277 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
directive_layer/security/directives_rules.xml Normal file
View File

@@ -0,0 +1,27 @@
<odoo>
<!--
Единое GLOBAL-правило видимости директив с диспетчерским bypass.
Почему одно global-правило, а не два (диспетчер / остальные):
в Odoo global-правила комбинируются по AND, а group-правила — по OR
и только РАСШИРЯЮТ доступ в пределах global. Поэтому global `own` НЕЛЬЗЯ
расширить group-правилом `all` для диспетчера (получилось бы own AND all = own).
Единственная форма, одновременно сохраняющая все три требования —
(1) диспетчер видит все,
(2) исполнитель/заявитель/автор видят только свои/ролевые,
(3) пользователь без ролей директив видит ноль строк (fail-closed),
— это одно global-правило с тернарным bypass для диспетчера.
Это осознанный, поведение-сохраняющий выбор (см. design.md §4.2),
а НЕ незавершённый рефактор «надо бы два правила».
Диспетчер (член role_directive_dispatcher_res_groups) -> домен [(1,'=',1)] (все).
Остальные -> 4 OR-условия через 3 оператора '|' (польская нотация):
своя как исполнитель / свои созданные / своя роль исполнителя / своя роль заявителя.
-->
<record id="rule_directive_base_access" model="ir.rule">
<field name="name">Directive: visibility (dispatcher sees all, others own/role)</field>
<field name="model_id" ref="model_directive_directive"/>
<field name="global" eval="True"/>
<field name="domain_force">[(1, '=', 1)] if user.has_group('directive_layer.role_directive_dispatcher_res_groups') else ['|', '|', '|', ('executor_user_id', '=', user.id), ('create_uid', '=', user.id), ('executor_role_id', 'in', user.role_ids.ids), ('requester_role_id', 'in', user.role_ids.ids)]</field>
</record>
</odoo>

34
directive_layer/security/ir.model.access.csv Normal file
View File

@@ -0,0 +1,34 @@
id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
access_directive_dispatcher,directive.directive dispatcher,model_directive_directive,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_executor,directive.directive executor,model_directive_directive,directive_layer.role_directive_executor_res_groups,1,1,0,0
access_directive_requester,directive.directive requester,model_directive_directive,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_policy_dispatcher,directive.policy dispatcher,model_directive_policy,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_policy_executor,directive.policy executor read,model_directive_policy,directive_layer.role_directive_executor_res_groups,1,0,0,0
access_directive_policy_requester,directive.policy requester read,model_directive_policy,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_stage_dispatcher,directive.stage dispatcher,model_directive_stage,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_stage_executor,directive.stage executor read,model_directive_stage,directive_layer.role_directive_executor_res_groups,1,0,0,0
access_directive_stage_requester,directive.stage requester read,model_directive_stage,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_work_type_dispatcher,directive.work.type dispatcher,model_directive_work_type,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_work_type_executor,directive.work.type executor read,model_directive_work_type,directive_layer.role_directive_executor_res_groups,1,0,0,0
access_directive_work_type_requester,directive.work.type requester read,model_directive_work_type,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_template_dispatcher,directive.template dispatcher,model_directive_template,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_template_executor,directive.template executor read,model_directive_template,directive_layer.role_directive_executor_res_groups,1,0,0,0
access_directive_template_requester,directive.template requester read,model_directive_template,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_template_group_dispatcher,directive.template.group dispatcher,model_directive_template_group,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_template_group_executor,directive.template.group executor read,model_directive_template_group,directive_layer.role_directive_executor_res_groups,1,0,0,0
access_directive_template_group_requester,directive.template.group requester read,model_directive_template_group,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_template_group_line_dispatcher,directive.template.group.line dispatcher,model_directive_template_group_line,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_template_group_line_executor,directive.template.group.line executor read,model_directive_template_group_line,directive_layer.role_directive_executor_res_groups,1,0,0,0
access_directive_template_group_line_requester,directive.template.group.line requester read,model_directive_template_group_line,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_origin_dispatcher,directive.origin dispatcher,model_directive_origin,directive_layer.role_directive_dispatcher_res_groups,1,1,1,1
access_directive_origin_executor,directive.origin executor read,model_directive_origin,directive_layer.role_directive_executor_res_groups,1,0,0,0
access_directive_origin_requester,directive.origin requester read,model_directive_origin,directive_layer.role_directive_requester_res_groups,1,0,0,0
access_directive_choose_group_wizard_executor,directive.choose.group.wizard executor,model_directive_choose_group_wizard,directive_layer.role_directive_executor_res_groups,1,0,1,0
access_directive_choose_group_wizard_requester,directive.choose.group.wizard requester,model_directive_choose_group_wizard,directive_layer.role_directive_requester_res_groups,1,0,1,0
access_directive_choose_group_wizard_dispatcher,directive.choose.group.wizard dispatcher,model_directive_choose_group_wizard,directive_layer.role_directive_dispatcher_res_groups,1,0,1,0
access_directive_delete_wizard_executor,directive.delete.wizard executor,model_directive_delete_wizard,directive_layer.role_directive_executor_res_groups,1,0,1,0
access_directive_delete_wizard_requester,directive.delete.wizard requester,model_directive_delete_wizard,directive_layer.role_directive_requester_res_groups,1,0,1,0
access_directive_delete_wizard_dispatcher,directive.delete.wizard dispatcher,model_directive_delete_wizard,directive_layer.role_directive_dispatcher_res_groups,1,0,1,0
access_directive_base_read,directive.directive base read,model_directive_directive,base.group_user,1,0,0,0
access_directive_origin_base_read,directive.origin base read,model_directive_origin,base.group_user,1,0,0,0
access_directive_stage_base_read,directive.stage base read,model_directive_stage,base.group_user,1,0,0,0
1 id name model_id:id group_id:id perm_read perm_write perm_create perm_unlink
2 access_directive_dispatcher directive.directive dispatcher model_directive_directive directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
3 access_directive_executor directive.directive executor model_directive_directive directive_layer.role_directive_executor_res_groups 1 1 0 0
4 access_directive_requester directive.directive requester model_directive_directive directive_layer.role_directive_requester_res_groups 1 0 0 0
5 access_directive_policy_dispatcher directive.policy dispatcher model_directive_policy directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
6 access_directive_policy_executor directive.policy executor read model_directive_policy directive_layer.role_directive_executor_res_groups 1 0 0 0
7 access_directive_policy_requester directive.policy requester read model_directive_policy directive_layer.role_directive_requester_res_groups 1 0 0 0
8 access_directive_stage_dispatcher directive.stage dispatcher model_directive_stage directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
9 access_directive_stage_executor directive.stage executor read model_directive_stage directive_layer.role_directive_executor_res_groups 1 0 0 0
10 access_directive_stage_requester directive.stage requester read model_directive_stage directive_layer.role_directive_requester_res_groups 1 0 0 0
11 access_directive_work_type_dispatcher directive.work.type dispatcher model_directive_work_type directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
12 access_directive_work_type_executor directive.work.type executor read model_directive_work_type directive_layer.role_directive_executor_res_groups 1 0 0 0
13 access_directive_work_type_requester directive.work.type requester read model_directive_work_type directive_layer.role_directive_requester_res_groups 1 0 0 0
14 access_directive_template_dispatcher directive.template dispatcher model_directive_template directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
15 access_directive_template_executor directive.template executor read model_directive_template directive_layer.role_directive_executor_res_groups 1 0 0 0
16 access_directive_template_requester directive.template requester read model_directive_template directive_layer.role_directive_requester_res_groups 1 0 0 0
17 access_directive_template_group_dispatcher directive.template.group dispatcher model_directive_template_group directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
18 access_directive_template_group_executor directive.template.group executor read model_directive_template_group directive_layer.role_directive_executor_res_groups 1 0 0 0
19 access_directive_template_group_requester directive.template.group requester read model_directive_template_group directive_layer.role_directive_requester_res_groups 1 0 0 0
20 access_directive_template_group_line_dispatcher directive.template.group.line dispatcher model_directive_template_group_line directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
21 access_directive_template_group_line_executor directive.template.group.line executor read model_directive_template_group_line directive_layer.role_directive_executor_res_groups 1 0 0 0
22 access_directive_template_group_line_requester directive.template.group.line requester read model_directive_template_group_line directive_layer.role_directive_requester_res_groups 1 0 0 0
23 access_directive_origin_dispatcher directive.origin dispatcher model_directive_origin directive_layer.role_directive_dispatcher_res_groups 1 1 1 1
24 access_directive_origin_executor directive.origin executor read model_directive_origin directive_layer.role_directive_executor_res_groups 1 0 0 0
25 access_directive_origin_requester directive.origin requester read model_directive_origin directive_layer.role_directive_requester_res_groups 1 0 0 0
26 access_directive_choose_group_wizard_executor directive.choose.group.wizard executor model_directive_choose_group_wizard directive_layer.role_directive_executor_res_groups 1 0 1 0
27 access_directive_choose_group_wizard_requester directive.choose.group.wizard requester model_directive_choose_group_wizard directive_layer.role_directive_requester_res_groups 1 0 1 0
28 access_directive_choose_group_wizard_dispatcher directive.choose.group.wizard dispatcher model_directive_choose_group_wizard directive_layer.role_directive_dispatcher_res_groups 1 0 1 0
29 access_directive_delete_wizard_executor directive.delete.wizard executor model_directive_delete_wizard directive_layer.role_directive_executor_res_groups 1 0 1 0
30 access_directive_delete_wizard_requester directive.delete.wizard requester model_directive_delete_wizard directive_layer.role_directive_requester_res_groups 1 0 1 0
31 access_directive_delete_wizard_dispatcher directive.delete.wizard dispatcher model_directive_delete_wizard directive_layer.role_directive_dispatcher_res_groups 1 0 1 0
32 access_directive_base_read directive.directive base read model_directive_directive base.group_user 1 0 0 0
33 access_directive_origin_base_read directive.origin base read model_directive_origin base.group_user 1 0 0 0
34 access_directive_stage_base_read directive.stage base read model_directive_stage base.group_user 1 0 0 0

40
directive_layer/security/roles.xml Normal file
View File

@@ -0,0 +1,40 @@
<odoo>
<!--
Технические группы res.groups: на них висят ir.model.access и record rules
(has_group), а также auto-install дашборда исполнителя.
Определены ВЫШЕ res.users.role, чтобы ref(...) в implied_ids резолвился.
-->
<record id="role_directive_executor_res_groups" model="res.groups">
<field name="name">Директивы / Исполнитель</field>
</record>
<record id="role_directive_requester_res_groups" model="res.groups">
<field name="name">Директивы / Заявитель</field>
</record>
<record id="role_directive_dispatcher_res_groups" model="res.groups">
<field name="name">Директивы / Диспетчер</field>
</record>
<!--
Бизнес-роли res.users.role (base_user_role): используются в полях
executor_role_id/requester_role_id и в record rule через user.role_ids.
Связаны с техническими res.groups через implied_ids: назначение бизнес-роли
пользователю (set_groups_from_roles) добавляет role.implied_ids -> пользователь
попадает в соответствующую _res_groups (иначе ACL/rules fail-shut).
-->
<record id="role_directive_executor" model="res.users.role">
<field name="name">Директивы / Исполнитель</field>
<field name="implied_ids" eval="[(4, ref('role_directive_executor_res_groups'))]"/>
</record>
<record id="role_directive_requester" model="res.users.role">
<field name="name">Директивы / Заявитель</field>
<field name="implied_ids" eval="[(4, ref('role_directive_requester_res_groups'))]"/>
</record>
<record id="role_directive_dispatcher" model="res.users.role">
<field name="name">Директивы / Диспетчер</field>
<field name="implied_ids" eval="[(4, ref('role_directive_dispatcher_res_groups'))]"/>
</record>
</odoo>