From f99f33a345d8f015c6bcaae86f44ea9964e906e5 Mon Sep 17 00:00:00 2001 From: KKamaa Date: Mon, 9 Sep 2024 11:53:04 +0300 Subject: [PATCH 01/11] Draft: [16.0][MIG] #10965 auditlog_security --- auditlog_security/README.rst | 95 ++++ auditlog_security/__init__.py | 3 + auditlog_security/__manifest__.py | 25 + auditlog_security/models/__init__.py | 7 + .../models/auditlog_line_access_rule.py | 121 +++++ auditlog_security/models/auditlog_log_line.py | 47 ++ auditlog_security/models/auditlog_rule.py | 127 +++++ auditlog_security/models/ir_rule.py | 16 + auditlog_security/readme/CONTRIBUTORS.rst | 1 + auditlog_security/readme/CREDITS.rst | 0 auditlog_security/readme/DESCRIPTION.rst | 3 + auditlog_security/readme/ROADMAP.rst | 1 + auditlog_security/readme/USAGE.rst | 11 + .../security/ir.model.access.csv | 3 + auditlog_security/security/ir_rule.xml | 15 + auditlog_security/security/res_groups.xml | 6 + .../static/description/index.html | 438 ++++++++++++++++++ auditlog_security/views/auditlog_view.xml | 151 ++++++ 18 files changed, 1070 insertions(+) create mode 100644 auditlog_security/README.rst create mode 100644 auditlog_security/__init__.py create mode 100644 auditlog_security/__manifest__.py create mode 100644 auditlog_security/models/__init__.py create mode 100644 auditlog_security/models/auditlog_line_access_rule.py create mode 100644 auditlog_security/models/auditlog_log_line.py create mode 100644 auditlog_security/models/auditlog_rule.py create mode 100644 auditlog_security/models/ir_rule.py create mode 100644 auditlog_security/readme/CONTRIBUTORS.rst create mode 100644 auditlog_security/readme/CREDITS.rst create mode 100644 auditlog_security/readme/DESCRIPTION.rst create mode 100644 auditlog_security/readme/ROADMAP.rst create mode 100644 auditlog_security/readme/USAGE.rst create mode 100644 auditlog_security/security/ir.model.access.csv create mode 100644 auditlog_security/security/ir_rule.xml create mode 100644 auditlog_security/security/res_groups.xml create mode 100644 auditlog_security/static/description/index.html create mode 100644 auditlog_security/views/auditlog_view.xml diff --git a/auditlog_security/README.rst b/auditlog_security/README.rst new file mode 100644 index 00000000000..438dfbd137a --- /dev/null +++ b/auditlog_security/README.rst @@ -0,0 +1,95 @@ +========================== +Audit Log User Permissions +========================== + +.. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--tools-lightgray.png?logo=github + :target: https://github.com/OCA/server-tools/tree/11.0/auditlog_security + :alt: OCA/server-tools +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/server-tools-11-0/server-tools-11-0-auditlog_security + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runbot-Try%20me-875A7B.png + :target: https://runbot.odoo-community.org/runbot/149/11.0 + :alt: Try me on Runbot + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This module allows extends auditlog, allowing specific log lines to be viewed only +by users belonging to specific views, while all other lines are allowed only to +administrator. + +**Table of contents** + +.. contents:: + :local: + +Usage +===== + +Go to `Settings / Technical / Audit / Rules` to subscribe rules. A rule defines +which operations to log for a given data model. +The rule is now extended with a new field permission_ids, that tells us wich groups will +be allowed to read the lines produced by this rule. +If permission_ids is left empty, the default will be: +"auditlog lines visible only by user in Settings group, which is the default +for the auditlog module" + + +Then, check logs in the `Settings / Technical / Audit / Logs` menu. You can +group them by user sessions, date, data model , HTTP requests. + +Known issues / Roadmap +====================== + + + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us smashing it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +~~~~~~~ + +* Therp B.V. + +Contributors +~~~~~~~~~~~~ + +* Giovanni Francesco Capalbo + +Maintainers +~~~~~~~~~~~ + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +This module is part of the `OCA/server-tools `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auditlog_security/__init__.py b/auditlog_security/__init__.py new file mode 100644 index 00000000000..31660d6a965 --- /dev/null +++ b/auditlog_security/__init__.py @@ -0,0 +1,3 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import models diff --git a/auditlog_security/__manifest__.py b/auditlog_security/__manifest__.py new file mode 100644 index 00000000000..22218b90eec --- /dev/null +++ b/auditlog_security/__manifest__.py @@ -0,0 +1,25 @@ +# Copyright 2021 Therp B.V. +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +{ + "name": "Audit Log User Permissions", + "version": "11.0.1.1.4", + "author": "Therp B.V.,Odoo Community Association (OCA)", + "license": "AGPL-3", + "website": "https://github.com/OCA/server-tools/", + "category": "Tools", + "description": """Allow regular users to view Audit log lines + via the form view of the relevant model""", + "depends": [ + "auditlog", + "contacts", + ], + "data": [ + "security/res_groups.xml", + "views/auditlog_view.xml", + "security/ir.model.access.csv", + "security/ir_rule.xml", + ], + "application": True, + "installable": True, +} diff --git a/auditlog_security/models/__init__.py b/auditlog_security/models/__init__.py new file mode 100644 index 00000000000..5b1ed36f36a --- /dev/null +++ b/auditlog_security/models/__init__.py @@ -0,0 +1,7 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from . import auditlog_rule +from . import auditlog_line_access_rule +from . import ir_rule +from . import auditlog_log_line + diff --git a/auditlog_security/models/auditlog_line_access_rule.py b/auditlog_security/models/auditlog_line_access_rule.py new file mode 100644 index 00000000000..573ac55b2b1 --- /dev/null +++ b/auditlog_security/models/auditlog_line_access_rule.py @@ -0,0 +1,121 @@ +# Copyright 2021 Therp B.V. +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from odoo import exceptions, models, fields, api, modules, _ +from odoo.addons.auditlog.models.rule import FIELDS_BLACKLIST + + +class AuditlogLineAccessRule(models.Model): + _name = "auditlog.line.access.rule" + + name = fields.Char() + + field_ids = fields.Many2many("ir.model.fields") + group_ids = fields.Many2many( + "res.groups", + help="""Groups that will be allowed to see the logged fields, if left empty + default will be all users with a login""", + ) + model_id = fields.Many2one( + "ir.model", related="auditlog_rule_id.model_id", readonly=True + ) + auditlog_rule_id = fields.Many2one( + "auditlog.rule", "auditlog_access_rule_ids", readonly=True, ondelete="cascade" + ) + state = fields.Selection(related="auditlog_rule_id.state", readonly=True) + + def needs_rule(self): + self.ensure_one() + return bool(self.group_ids) + + def get_linked_rules(self): + return self.env["ir.rule"].search( + [("auditlog_line_access_rule_id", "in", self.ids)] + ) + + def unlink(self): + to_delete = self.get_linked_rules() + res = super(AuditlogLineAccessRule, self).unlink() + if res: + res = res and to_delete.unlink() + return res + + def add_default_group_if_needed(self): + self.ensure_one() + res = False + if not self.group_ids and self.field_ids: + res = self.with_context(no_iter=True).write( + {"group_ids": [(6, 0, [self.env.ref("base.group_user").id])]} + ) + return res + + @api.model + def create(self, vals): + res = super(AuditlogLineAccessRule, self).create(vals) + res.add_default_group_if_needed() + res.regenerate_rules() + return res + + @api.multi + def write(self, vals): + res = super(AuditlogLineAccessRule, self).write(vals) + for this in self: + added = this.add_default_group_if_needed() + if ( + any( + [ + x in vals + for x in ("group_ids", "field_ids", "model_id", "all_fields") + ] + ) + or added + ): + this.regenerate_rules() + + return res + + def remove_rules(self): + for this in self: + this.get_linked_rules().unlink() + + def regenerate_rules(self): + for this in self: + this.remove_rules() + dict_values = this._prepare_rule_values() + for values in dict_values: + self.env["ir.rule"].create(values) + + def _prepare_rule_values(self): + self.ensure_one() + if not self.needs_rule(): + return [] + domain_force = "[" + " ('log_id.model_id' , '=', %s)," % ( + self.model_id.id + ) + if self.field_ids: + domain_force = "[('field_id', 'in', %s)]" % (self.field_ids.ids) + model = self.env.ref("auditlog.model_auditlog_log_line") + else: + domain_force = "[('model_id', '=', %s)]" % (self.model_id.id) + model = self.env.ref("auditlog.model_auditlog_log") + auditlog_security_group = self.env.ref( + 'auditlog_security.group_can_view_audit_logs') + return [ + { + "name": "auditlog_extended_%s" % self.id, + "model_id": model.id, + "groups": [(6, 0, self.group_ids.ids)], + "perm_read": True, + "domain_force": domain_force, + "auditlog_line_access_rule_id": self.id, + }, + { + "name": "auditlog_extended_%s" % self.id, + "model_id": model.id, + "groups": [(6, 0, [auditlog_security_group.id])], + "perm_read": True, + "domain_force": [(1, '=', 1)], + "auditlog_line_access_rule_id": self.id, + }] + + diff --git a/auditlog_security/models/auditlog_log_line.py b/auditlog_security/models/auditlog_log_line.py new file mode 100644 index 00000000000..e7698e2c2cf --- /dev/null +++ b/auditlog_security/models/auditlog_log_line.py @@ -0,0 +1,47 @@ +# Copyright 2022 Therp B.V. +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from odoo import api, exceptions, models, fields + + +class AuditlogLogLine(models.Model): + _inherit = 'auditlog.log.line' + _order = "create_date desc" + + user_id = fields.Many2one( + 'res.users', + compute="compute_user_id", + store=True, + index=True, + string="User", + ) + method = fields.Char("Method", compute='compute_method', store=True, index=True) + model_id = fields.Many2one( + "ir.model", + compute='compute_model_id', + store=True, + index=True) + res_id = fields.Integer( + compute='compute_res_id', + store=True, + index=True) + + @api.depends('log_id.method') + def compute_method(self): + for this in self: + this.method=this.log_id.method + + @api.depends('log_id.user_id') + def compute_user_id(self): + for this in self: + this.user_id=this.log_id.user_id + + @api.depends('log_id.model_id') + def compute_model_id(self): + for this in self: + this.model_id=this.log_id.model_id + + @api.depends('log_id.res_id') + def compute_res_id(self): + for this in self: + this.res_id=this.log_id.res_id diff --git a/auditlog_security/models/auditlog_rule.py b/auditlog_security/models/auditlog_rule.py new file mode 100644 index 00000000000..76ac9003648 --- /dev/null +++ b/auditlog_security/models/auditlog_rule.py @@ -0,0 +1,127 @@ +# Copyright 2021 Therp B.V. +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from odoo import exceptions, models, fields, api, modules, _, tools +from odoo.addons.auditlog.models.rule import FIELDS_BLACKLIST +from odoo.exceptions import ValidationError, UserError + +class AuditlogRule(models.Model): + _inherit = "auditlog.rule" + + auditlog_line_access_rule_ids = fields.One2many( + "auditlog.line.access.rule", "auditlog_rule_id", ondelete="cascade" + ) + server_action_id = fields.Many2one('ir.actions.server', "Server Action",) + log_selected_fields_only = fields.Boolean( + default=True, + help="Log only the selected fields, to save space avoid large DB data.") + + @api.constrains('model_id') + def unique_model(self): + if self.search_count([('model_id', '=', self.model_id.id)]) > 1: + raise ValidationError("A rule for this model already exists") + + @api.model + @tools.ormcache('model_name') + def _get_field_names_of_rule(self, model_name): + """ Memory-cached list of fields per rule """ + rule = self.env['auditlog.rule'].sudo().search( + [('model_id.model', '=', model_name)], limit=1) + if rule.auditlog_line_access_rule_ids: + return rule.mapped( + 'auditlog_line_access_rule_ids.field_ids.name') + return [] + + @api.model + @tools.ormcache('model_name') + def _get_log_selected_fields_only(self, model_name): + """ Memory-cached translation of model to rule """ + rule = self.env['auditlog.rule'].sudo().search( + [('model_id.model', '=', model_name)], limit=1) + return rule.log_selected_fields_only + + @api.model + def get_auditlog_fields(self, model): + res = super(AuditlogRule, self).get_auditlog_fields(model) + if self._get_log_selected_fields_only(model._name): + selected_field_names = self._get_field_names_of_rule(model._name) + # we re-use the checks on non-stored fields from super. + res = [x for x in selected_field_names if x in res] + return res + + @api.multi + def write(self, values): + cache_invalidating_fields = [ + "state", + "auditlog_line_access_rule_ids", + "log_selected_fields_only", + ] + if any([field in values.keys() for field in cache_invalidating_fields]): + # clear cache for all ormcache methods. + self.clear_caches() + return super(AuditlogRule, self).write(values) + + @api.onchange("model_id") + def onchange_model_id(self): + # if model changes we must wipe out all field ids + self.auditlog_line_access_rule_ids.unlink() + + @api.model + def _get_view_log_lines_action(self): + assert(self.env.context.get('active_model')) + assert(self.env.context.get('active_ids')) + model = self.env['ir.model'].sudo().search([ + ('model', '=', self.env.context.get('active_model')) + ]) + domain = [ + ('model_id', '=', model.id), + ('res_id', 'in', self.env.context.get('active_ids')), + ] + return { + "name": _("View Log Lines"), + "res_model": "auditlog.log.line", + "view_mode": "tree,form", + "view_id": False, + "domain": domain, + "type": "ir.actions.act_window", + } + + @api.multi + def _create_server_action(self): + self.ensure_one() + code = \ + "action = env['auditlog.rule']._get_view_log_lines_action()" + server_action = self.env['ir.actions.server'].sudo().create({ + 'name': "View Log Lines", + 'model_id': self.model_id.id, + 'state': "code", + 'code': code + }) + self.write({ + 'server_action_id': server_action.id + }) + return server_action + + @api.multi + def subscribe(self): + for rule in self: + server_action = rule._create_server_action() + server_action.create_action() + res = super(AuditlogRule, self).subscribe() + for rule in self: + rule.auditlog_line_access_rule_ids.regenerate_rules() + # rule now will have "View Log" Action, make that visible only for admin + if res: + self.action_id.write({ + 'groups_id': [(6, 0, [self.env.ref('base.group_system').id])] + }) + return res + + @api.multi + def unsubscribe(self): + for rule in self: + rule.auditlog_line_access_rule_ids.remove_rules() + for rule in self: + rule.server_action_id.unlink() + return super(AuditlogRule, self).unsubscribe() + diff --git a/auditlog_security/models/ir_rule.py b/auditlog_security/models/ir_rule.py new file mode 100644 index 00000000000..665b58f0507 --- /dev/null +++ b/auditlog_security/models/ir_rule.py @@ -0,0 +1,16 @@ +# Copyright 2021 Therp B.V. +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +from odoo import exceptions, models, fields, api, _ + + +class IrRule(models.Model): + _inherit = "ir.rule" + + auditlog_line_access_rule_id = fields.Many2one( + "auditlog.line.access.rule", + required=False, + index=True, + ondelete='cascade', + help="Auditlog line access Rule that generated this ir.rule", + ) diff --git a/auditlog_security/readme/CONTRIBUTORS.rst b/auditlog_security/readme/CONTRIBUTORS.rst new file mode 100644 index 00000000000..addcc3f4a2b --- /dev/null +++ b/auditlog_security/readme/CONTRIBUTORS.rst @@ -0,0 +1 @@ +* Giovanni Francesco Capalbo diff --git a/auditlog_security/readme/CREDITS.rst b/auditlog_security/readme/CREDITS.rst new file mode 100644 index 00000000000..e69de29bb2d diff --git a/auditlog_security/readme/DESCRIPTION.rst b/auditlog_security/readme/DESCRIPTION.rst new file mode 100644 index 00000000000..2d056774e16 --- /dev/null +++ b/auditlog_security/readme/DESCRIPTION.rst @@ -0,0 +1,3 @@ +This module allows extends auditlog, allowing specific log lines to be viewed only +by users belonging to specific views, while all other lines are allowed only to +administrator. diff --git a/auditlog_security/readme/ROADMAP.rst b/auditlog_security/readme/ROADMAP.rst new file mode 100644 index 00000000000..8b137891791 --- /dev/null +++ b/auditlog_security/readme/ROADMAP.rst @@ -0,0 +1 @@ + diff --git a/auditlog_security/readme/USAGE.rst b/auditlog_security/readme/USAGE.rst new file mode 100644 index 00000000000..f4cfaeca2cf --- /dev/null +++ b/auditlog_security/readme/USAGE.rst @@ -0,0 +1,11 @@ +Go to `Settings / Technical / Audit / Rules` to subscribe rules. A rule defines +which operations to log for a given data model. +The rule is now extended with a new field permission_ids, that tells us wich groups will +be allowed to read the lines produced by this rule. +If permission_ids is left empty, the default will be: +"auditlog lines visible only by user in Settings group, which is the default +for the auditlog module" + + +Then, check logs in the `Settings / Technical / Audit / Logs` menu. You can +group them by user sessions, date, data model , HTTP requests. diff --git a/auditlog_security/security/ir.model.access.csv b/auditlog_security/security/ir.model.access.csv new file mode 100644 index 00000000000..eba2422b41f --- /dev/null +++ b/auditlog_security/security/ir.model.access.csv @@ -0,0 +1,3 @@ +id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink +access_auditlog_log_line_user,auditlog_log_line_user,auditlog.model_auditlog_log_line,base.group_user,1,0,0,0 +access_auditlog_line_access_rule_admin,auditlog_line_access_rule_admin,model_auditlog_line_access_rule,base.group_erp_manager,1,1,1,1 \ No newline at end of file diff --git a/auditlog_security/security/ir_rule.xml b/auditlog_security/security/ir_rule.xml new file mode 100644 index 00000000000..d783eb6f6d2 --- /dev/null +++ b/auditlog_security/security/ir_rule.xml @@ -0,0 +1,15 @@ + + + + + Nobody can read by default + + [(0, '=', 1)] + + + + + + + + diff --git a/auditlog_security/security/res_groups.xml b/auditlog_security/security/res_groups.xml new file mode 100644 index 00000000000..2b4fd7171c9 --- /dev/null +++ b/auditlog_security/security/res_groups.xml @@ -0,0 +1,6 @@ + + + + View Audit Logs + + diff --git a/auditlog_security/static/description/index.html b/auditlog_security/static/description/index.html new file mode 100644 index 00000000000..03f14d1e6be --- /dev/null +++ b/auditlog_security/static/description/index.html @@ -0,0 +1,438 @@ + + + + + + +Audit Log User Permissions + + + +
+

Audit Log User Permissions

+ + +

Beta License: AGPL-3 OCA/server-tools Translate me on Weblate Try me on Runbot

+

This module allows extends auditlog, allowing specific log lines to be viewed only +by users belonging to specific views, while all other lines are allowed only to +administrator.

+

Table of contents

+ +
+

Usage

+

Go to Settings / Technical / Audit / Rules to subscribe rules. A rule defines +which operations to log for a given data model. +The rule is now extended with a new field permission_ids, that tells us wich groups will +be allowed to read the lines produced by this rule. +If permission_ids is left empty, the default will be: +“auditlog lines visible only by user in Settings group, which is the default +for the auditlog module”

+

Then, check logs in the Settings / Technical / Audit / Logs menu. You can +group them by user sessions, date, data model , HTTP requests.

+
+ +
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us smashing it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • Therp B.V.
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is maintained by the OCA.

+Odoo Community Association +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

This module is part of the OCA/server-tools project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+ + diff --git a/auditlog_security/views/auditlog_view.xml b/auditlog_security/views/auditlog_view.xml new file mode 100644 index 00000000000..3050c1d7517 --- /dev/null +++ b/auditlog_security/views/auditlog_view.xml @@ -0,0 +1,151 @@ + + + + auditlog.log.form + auditlog.log + + + + false + + + + + + auditlog.log.form + auditlog.log + + + + false + + + + + + + + + + + + + auditlog.log.line.form + auditlog.log.line + +
+ + + + + + + + + + + +
+ + + + + auditlog.log.line.tree + auditlog.log.line + + + + + + + + + + + + + + View Log Lines + ir.actions.act_window + auditlog.log.line + tree,form + + + + + + + auditlog rule form extension + auditlog.rule + + + + +
+

+ Add fields here to make any changes to them (audit log lines) + visible to members of the selected groups. +

+
+ + + + + + + + + + + +
+ + + + + + + + + +
+ + + + + + + + auditlog rule tree extension + auditlog.rule + + + + + + + + + + + + + + + From 15c16c044628b4eade1dd5ff62509146643a7f16 Mon Sep 17 00:00:00 2001 From: KKamaa Date: Mon, 9 Sep 2024 12:11:33 +0300 Subject: [PATCH 02/11] [UPD] black,isort,prettier --- auditlog_security/README.rst | 23 +++-- auditlog_security/__manifest__.py | 6 +- auditlog_security/models/__init__.py | 1 - .../models/auditlog_line_access_rule.py | 45 +++++---- auditlog_security/models/auditlog_log_line.py | 49 +++++----- auditlog_security/models/auditlog_rule.py | 93 +++++++++++-------- auditlog_security/models/ir_rule.py | 4 +- .../security/ir.model.access.csv | 2 +- auditlog_security/security/ir_rule.xml | 17 ++-- .../static/description/index.html | 54 ++++++----- auditlog_security/views/auditlog_view.xml | 86 ++++++++++------- .../odoo/addons/auditlog_security | 1 + setup/auditlog_security/setup.py | 6 ++ 13 files changed, 211 insertions(+), 176 deletions(-) create mode 120000 setup/auditlog_security/odoo/addons/auditlog_security create mode 100644 setup/auditlog_security/setup.py diff --git a/auditlog_security/README.rst b/auditlog_security/README.rst index 438dfbd137a..4d2873382aa 100644 --- a/auditlog_security/README.rst +++ b/auditlog_security/README.rst @@ -2,10 +2,13 @@ Audit Log User Permissions ========================== -.. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! This file is generated by oca-gen-addon-readme !! !! changes will be overwritten. !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:f98c0209d43e543c4900a35144d6189d6a65aa2a3e462333582408b79f57c733 + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! .. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png :target: https://odoo-community.org/page/development-status @@ -14,16 +17,16 @@ Audit Log User Permissions :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html :alt: License: AGPL-3 .. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--tools-lightgray.png?logo=github - :target: https://github.com/OCA/server-tools/tree/11.0/auditlog_security + :target: https://github.com/OCA/server-tools/tree/16.0/auditlog_security :alt: OCA/server-tools .. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png - :target: https://translation.odoo-community.org/projects/server-tools-11-0/server-tools-11-0-auditlog_security + :target: https://translation.odoo-community.org/projects/server-tools-16-0/server-tools-16-0-auditlog_security :alt: Translate me on Weblate -.. |badge5| image:: https://img.shields.io/badge/runbot-Try%20me-875A7B.png - :target: https://runbot.odoo-community.org/runbot/149/11.0 - :alt: Try me on Runbot +.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png + :target: https://runboat.odoo-community.org/builds?repo=OCA/server-tools&target_branch=16.0 + :alt: Try me on Runboat -|badge1| |badge2| |badge3| |badge4| |badge5| +|badge1| |badge2| |badge3| |badge4| |badge5| This module allows extends auditlog, allowing specific log lines to be viewed only by users belonging to specific views, while all other lines are allowed only to @@ -59,8 +62,8 @@ Bug Tracker Bugs are tracked on `GitHub Issues `_. In case of trouble, please check there if your issue has already been reported. -If you spotted it first, help us smashing it by providing a detailed and welcomed -`feedback `_. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. Do not contact contributors directly about support or help with technical issues. @@ -90,6 +93,6 @@ OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use. -This module is part of the `OCA/server-tools `_ project on GitHub. +This module is part of the `OCA/server-tools `_ project on GitHub. You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auditlog_security/__manifest__.py b/auditlog_security/__manifest__.py index 22218b90eec..7af1284b967 100644 --- a/auditlog_security/__manifest__.py +++ b/auditlog_security/__manifest__.py @@ -3,12 +3,12 @@ { "name": "Audit Log User Permissions", - "version": "11.0.1.1.4", + "version": "16.0.1.0.0", "author": "Therp B.V.,Odoo Community Association (OCA)", "license": "AGPL-3", - "website": "https://github.com/OCA/server-tools/", + "website": "https://github.com/OCA/server-tools", "category": "Tools", - "description": """Allow regular users to view Audit log lines + "summary": """Allow regular users to view Audit log lines via the form view of the relevant model""", "depends": [ "auditlog", diff --git a/auditlog_security/models/__init__.py b/auditlog_security/models/__init__.py index 5b1ed36f36a..38b8d3409b4 100644 --- a/auditlog_security/models/__init__.py +++ b/auditlog_security/models/__init__.py @@ -4,4 +4,3 @@ from . import auditlog_line_access_rule from . import ir_rule from . import auditlog_log_line - diff --git a/auditlog_security/models/auditlog_line_access_rule.py b/auditlog_security/models/auditlog_line_access_rule.py index 573ac55b2b1..621a5e96c2d 100644 --- a/auditlog_security/models/auditlog_line_access_rule.py +++ b/auditlog_security/models/auditlog_line_access_rule.py @@ -1,8 +1,7 @@ # Copyright 2021 Therp B.V. # License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). -from odoo import exceptions, models, fields, api, modules, _ -from odoo.addons.auditlog.models.rule import FIELDS_BLACKLIST +from odoo import api, fields, models class AuditlogLineAccessRule(models.Model): @@ -89,9 +88,7 @@ def _prepare_rule_values(self): self.ensure_one() if not self.needs_rule(): return [] - domain_force = "[" + " ('log_id.model_id' , '=', %s)," % ( - self.model_id.id - ) + domain_force = "[" + " ('log_id.model_id' , '=', %s)," % (self.model_id.id) if self.field_ids: domain_force = "[('field_id', 'in', %s)]" % (self.field_ids.ids) model = self.env.ref("auditlog.model_auditlog_log_line") @@ -99,23 +96,23 @@ def _prepare_rule_values(self): domain_force = "[('model_id', '=', %s)]" % (self.model_id.id) model = self.env.ref("auditlog.model_auditlog_log") auditlog_security_group = self.env.ref( - 'auditlog_security.group_can_view_audit_logs') + "auditlog_security.group_can_view_audit_logs" + ) return [ - { - "name": "auditlog_extended_%s" % self.id, - "model_id": model.id, - "groups": [(6, 0, self.group_ids.ids)], - "perm_read": True, - "domain_force": domain_force, - "auditlog_line_access_rule_id": self.id, - }, - { - "name": "auditlog_extended_%s" % self.id, - "model_id": model.id, - "groups": [(6, 0, [auditlog_security_group.id])], - "perm_read": True, - "domain_force": [(1, '=', 1)], - "auditlog_line_access_rule_id": self.id, - }] - - + { + "name": "auditlog_extended_%s" % self.id, + "model_id": model.id, + "groups": [(6, 0, self.group_ids.ids)], + "perm_read": True, + "domain_force": domain_force, + "auditlog_line_access_rule_id": self.id, + }, + { + "name": "auditlog_extended_%s" % self.id, + "model_id": model.id, + "groups": [(6, 0, [auditlog_security_group.id])], + "perm_read": True, + "domain_force": [(1, "=", 1)], + "auditlog_line_access_rule_id": self.id, + }, + ] diff --git a/auditlog_security/models/auditlog_log_line.py b/auditlog_security/models/auditlog_log_line.py index e7698e2c2cf..43cce73a5de 100644 --- a/auditlog_security/models/auditlog_log_line.py +++ b/auditlog_security/models/auditlog_log_line.py @@ -1,47 +1,42 @@ # Copyright 2022 Therp B.V. # License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). -from odoo import api, exceptions, models, fields +from odoo import api, fields, models class AuditlogLogLine(models.Model): - _inherit = 'auditlog.log.line' + _inherit = "auditlog.log.line" _order = "create_date desc" user_id = fields.Many2one( - 'res.users', - compute="compute_user_id", + "res.users", + compute="_compute_user_id", store=True, index=True, string="User", ) - method = fields.Char("Method", compute='compute_method', store=True, index=True) + method = fields.Char(compute="_compute_method", store=True, index=True) model_id = fields.Many2one( - "ir.model", - compute='compute_model_id', - store=True, - index=True) - res_id = fields.Integer( - compute='compute_res_id', - store=True, - index=True) - - @api.depends('log_id.method') - def compute_method(self): + "ir.model", compute="_compute_model_id", store=True, index=True + ) + res_id = fields.Integer(compute="_compute_res_id", store=True, index=True) + + @api.depends("log_id.method") + def _compute_method(self): for this in self: - this.method=this.log_id.method + this.method = this.log_id.method - @api.depends('log_id.user_id') - def compute_user_id(self): + @api.depends("log_id.user_id") + def _compute_user_id(self): for this in self: - this.user_id=this.log_id.user_id + this.user_id = this.log_id.user_id - @api.depends('log_id.model_id') - def compute_model_id(self): + @api.depends("log_id.model_id") + def _compute_model_id(self): for this in self: - this.model_id=this.log_id.model_id - - @api.depends('log_id.res_id') - def compute_res_id(self): + this.model_id = this.log_id.model_id + + @api.depends("log_id.res_id") + def _compute_res_id(self): for this in self: - this.res_id=this.log_id.res_id + this.res_id = this.log_id.res_id diff --git a/auditlog_security/models/auditlog_rule.py b/auditlog_security/models/auditlog_rule.py index 76ac9003648..c75a5e8897b 100644 --- a/auditlog_security/models/auditlog_rule.py +++ b/auditlog_security/models/auditlog_rule.py @@ -1,9 +1,9 @@ # Copyright 2021 Therp B.V. # License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). -from odoo import exceptions, models, fields, api, modules, _, tools -from odoo.addons.auditlog.models.rule import FIELDS_BLACKLIST -from odoo.exceptions import ValidationError, UserError +from odoo import _, api, fields, models, tools +from odoo.exceptions import ValidationError + class AuditlogRule(models.Model): _inherit = "auditlog.rule" @@ -11,33 +11,42 @@ class AuditlogRule(models.Model): auditlog_line_access_rule_ids = fields.One2many( "auditlog.line.access.rule", "auditlog_rule_id", ondelete="cascade" ) - server_action_id = fields.Many2one('ir.actions.server', "Server Action",) + server_action_id = fields.Many2one( + "ir.actions.server", + "Server Action", + ) log_selected_fields_only = fields.Boolean( default=True, - help="Log only the selected fields, to save space avoid large DB data.") + help="Log only the selected fields, to save space avoid large DB data.", + ) - @api.constrains('model_id') + @api.constrains("model_id") def unique_model(self): - if self.search_count([('model_id', '=', self.model_id.id)]) > 1: - raise ValidationError("A rule for this model already exists") + if self.search_count([("model_id", "=", self.model_id.id)]) > 1: + raise ValidationError(_("A rule for this model already exists")) @api.model - @tools.ormcache('model_name') + @tools.ormcache("model_name") def _get_field_names_of_rule(self, model_name): - """ Memory-cached list of fields per rule """ - rule = self.env['auditlog.rule'].sudo().search( - [('model_id.model', '=', model_name)], limit=1) + """Memory-cached list of fields per rule""" + rule = ( + self.env["auditlog.rule"] + .sudo() + .search([("model_id.model", "=", model_name)], limit=1) + ) if rule.auditlog_line_access_rule_ids: - return rule.mapped( - 'auditlog_line_access_rule_ids.field_ids.name') + return rule.mapped("auditlog_line_access_rule_ids.field_ids.name") return [] @api.model - @tools.ormcache('model_name') + @tools.ormcache("model_name") def _get_log_selected_fields_only(self, model_name): - """ Memory-cached translation of model to rule """ - rule = self.env['auditlog.rule'].sudo().search( - [('model_id.model', '=', model_name)], limit=1) + """Memory-cached translation of model to rule""" + rule = ( + self.env["auditlog.rule"] + .sudo() + .search([("model_id.model", "=", model_name)], limit=1) + ) return rule.log_selected_fields_only @api.model @@ -68,14 +77,16 @@ def onchange_model_id(self): @api.model def _get_view_log_lines_action(self): - assert(self.env.context.get('active_model')) - assert(self.env.context.get('active_ids')) - model = self.env['ir.model'].sudo().search([ - ('model', '=', self.env.context.get('active_model')) - ]) + assert self.env.context.get("active_model") + assert self.env.context.get("active_ids") + model = ( + self.env["ir.model"] + .sudo() + .search([("model", "=", self.env.context.get("active_model"))]) + ) domain = [ - ('model_id', '=', model.id), - ('res_id', 'in', self.env.context.get('active_ids')), + ("model_id", "=", model.id), + ("res_id", "in", self.env.context.get("active_ids")), ] return { "name": _("View Log Lines"), @@ -89,17 +100,20 @@ def _get_view_log_lines_action(self): @api.multi def _create_server_action(self): self.ensure_one() - code = \ - "action = env['auditlog.rule']._get_view_log_lines_action()" - server_action = self.env['ir.actions.server'].sudo().create({ - 'name': "View Log Lines", - 'model_id': self.model_id.id, - 'state': "code", - 'code': code - }) - self.write({ - 'server_action_id': server_action.id - }) + code = "action = env['auditlog.rule']._get_view_log_lines_action()" + server_action = ( + self.env["ir.actions.server"] + .sudo() + .create( + { + "name": "View Log Lines", + "model_id": self.model_id.id, + "state": "code", + "code": code, + } + ) + ) + self.write({"server_action_id": server_action.id}) return server_action @api.multi @@ -112,9 +126,9 @@ def subscribe(self): rule.auditlog_line_access_rule_ids.regenerate_rules() # rule now will have "View Log" Action, make that visible only for admin if res: - self.action_id.write({ - 'groups_id': [(6, 0, [self.env.ref('base.group_system').id])] - }) + self.action_id.write( + {"groups_id": [(6, 0, [self.env.ref("base.group_system").id])]} + ) return res @api.multi @@ -124,4 +138,3 @@ def unsubscribe(self): for rule in self: rule.server_action_id.unlink() return super(AuditlogRule, self).unsubscribe() - diff --git a/auditlog_security/models/ir_rule.py b/auditlog_security/models/ir_rule.py index 665b58f0507..59e926edc06 100644 --- a/auditlog_security/models/ir_rule.py +++ b/auditlog_security/models/ir_rule.py @@ -1,7 +1,7 @@ # Copyright 2021 Therp B.V. # License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). -from odoo import exceptions, models, fields, api, _ +from odoo import fields, models class IrRule(models.Model): @@ -11,6 +11,6 @@ class IrRule(models.Model): "auditlog.line.access.rule", required=False, index=True, - ondelete='cascade', + ondelete="cascade", help="Auditlog line access Rule that generated this ir.rule", ) diff --git a/auditlog_security/security/ir.model.access.csv b/auditlog_security/security/ir.model.access.csv index eba2422b41f..1d82edf2108 100644 --- a/auditlog_security/security/ir.model.access.csv +++ b/auditlog_security/security/ir.model.access.csv @@ -1,3 +1,3 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink access_auditlog_log_line_user,auditlog_log_line_user,auditlog.model_auditlog_log_line,base.group_user,1,0,0,0 -access_auditlog_line_access_rule_admin,auditlog_line_access_rule_admin,model_auditlog_line_access_rule,base.group_erp_manager,1,1,1,1 \ No newline at end of file +access_auditlog_line_access_rule_admin,auditlog_line_access_rule_admin,model_auditlog_line_access_rule,base.group_erp_manager,1,1,1,1 diff --git a/auditlog_security/security/ir_rule.xml b/auditlog_security/security/ir_rule.xml index d783eb6f6d2..dfea064c1c5 100644 --- a/auditlog_security/security/ir_rule.xml +++ b/auditlog_security/security/ir_rule.xml @@ -1,15 +1,18 @@ - + Nobody can read by default - + [(0, '=', 1)] - - - - - + + + + + diff --git a/auditlog_security/static/description/index.html b/auditlog_security/static/description/index.html index 03f14d1e6be..80174bc2755 100644 --- a/auditlog_security/static/description/index.html +++ b/auditlog_security/static/description/index.html @@ -1,20 +1,20 @@ - - + Audit Log User Permissions