Record rules : only a specific user (creator) could modify his record ?

[Maxime Richez]

Hi everybody,

In my new module, i would like everyone can add a record and see records from other people but only the creator of a record could modify his record. Is it possible ?
Here's is my rule, but it's not working :

<record model="ir.model.access" id="access_mymodule">
            <field name="model" search="[('model', '=', 'mymodule')]"/>
            <field name="perm_read" eval="True"/>
            <field name="perm_write" eval="False"/>
            <field name="perm_create" eval="True"/>
            <field name="perm_delete" eval="False"/>
        </record>

        <record model="ir.rule.group" id="rule_group_creator_mymodule">
            <field name="model" search="[('model', '=', 'mymodule')]"/>
            <field name="global_p" eval="False"/>
            <field name="default_p" eval="False"/>
            <field name="perm_write" eval="True"/>
            <field name="perm_delete" eval="True"/>
        </record>
        <record model="ir.rule" id="rule_creator_mymodule">
            <field name="domain"
                eval="[('create_uid', '=', Eval('user', {}).get('id', -1))]"
                pyson="1"/>
            <field name="rule_group" ref="rule_group_creator_mymodule"/>
        </record>

[Cédric Krier]

On 2016-06-09 05:16, Maxime Richez wrote:
> Hi everybody,
>
> In my new module, i would like everyone can add a record and see records
> from other people but only the creator of a record could modify his record.
> Is it possible ?
> Here's is my rule, but it's not working :
>
> <record model="ir.model.access" id="access_mymodule">
> <field name="model" search="[('model', '=', 'mymodule')]"/>
> <field name="perm_read" eval="True"/>
> <field name="perm_write" eval="False"/>
> <field name="perm_create" eval="True"/>
> <field name="perm_delete" eval="False"/>
> </record>
>
> <record model="ir.rule.group" id="rule_group_creator_mymodule">
> <field name="model" search="[('model', '=', 'mymodule')]"/>
> <field name="global_p" eval="False"/>
> <field name="default_p" eval="False"/>

As it is neither global nor default, are you sure you have added the
rule to a user when testing?

> <field name="perm_write" eval="True"/>
> <field name="perm_delete" eval="True"/>
> </record>
> <record model="ir.rule" id="rule_creator_mymodule">
> <field name="domain"
> eval="[('create_uid', '=', Eval('user', {}).get('id', -1))]"
> pyson="1"/>
> <field name="rule_group" ref="rule_group_creator_mymodule"/>
> </record>

--
Cédric Krier - B2CK SPRL
Email/Jabber: cedric...@b2ck.com
Tel: +32 472 54 46 59
Website: http://www.b2ck.com/

[Maxime Richez]

As it is neither global nor default, are you sure you have added the
rule to a user when testing?

Effectively, my rule is not added for a user, i'll set rule default.
And how to add a rule to a specific user in the xml file ? <field name="user" ref ??? >
How can i apply my domain only when user try to modify a record ? Because if i apply the domain, i only see user's records and not all records..

[Cédric Krier]

On 2016-06-09 06:21, Maxime Richez wrote:
>
> > As it is neither global nor default, are you sure you have added the
> > rule to a user when testing?
> >
> Effectively, my rule is not added for a user, i'll set rule default.
> And how to add a rule to a specific user in the xml file ? <field
> name="user" ref ??? >

You must create a record of type: ir.rule.group-res.user
But I think we should remove this per user basis to work only with
group: ir.rule.group-res.group

> How can i apply my domain only when user try to modify a record ? Because
> if i apply the domain, i only see user's records and not all records..

You have to create a global rule with perm_read for all (empty domain).

[Maxime Richez]

You have to create a global rule with perm_read for all (empty domain).

Oki thanks Cédric. It's working now :-)
Is there a way to change/personalize  "Error Message : You try to bypass an access rule (Document type: mymodel)"  ?
Here's my new rules :

        <record model="ir.rule.group" id="rule_group_mymodel">
            <field name="model" search="[('model', '=', 'mymodel')]"/>

            <field name="global_p" eval="False"/>

            <field name="default_p" eval="True"/>

            <field name="perm_read" eval="True"/>

            <field name="perm_create" eval="True"/>
        </record>
        <record model="ir.rule" id="rule_group_mymodel_line1">
             <field name="domain" eval="[]" pyson="1"/>
            <field name="rule_group" ref="rule_group_mymodel"/>
        </record>

        <record model="ir.rule.group" id="rule_group_creator_mymodel">
            <field name="model" search="[('model', '=', 'mymodel')]"/>

            <field name="global_p" eval="False"/>

            <field name="default_p" eval="True"/>

            <field name="perm_write" eval="True"/>
            <field name="perm_delete" eval="True"/>
        </record>

        <record model="ir.rule" id="rule_creator_mymodel">

            <field name="domain"
                eval="[('create_uid', '=', Eval('user', {}).get('id', -1))]"
                pyson="1"/>

            <field name="rule_group" ref="rule_group_creator_mymodel"/>
        </record>

 

[Cédric Krier]

On 2016-06-10 00:24, Maxime Richez wrote:
>
>
> >
> > You have to create a global rule with perm_read for all (empty domain).
> >
> >
> Oki thanks Cédric. It's working now :-)
> Is there a way to change/personalize "Error Message : You try to bypass an
> access rule (Document type: mymodel)" ?

No but maybe it could be improved for future version like saying which
kind of access etc.
Otherwise you could try to prevent to have such error message by making
readonly (with states) record fields for which the user has no access write.
It is a little bit more work but the experience for the user will be
better.

[Maxime Richez]

Otherwise you could try to prevent to have such error message by making
readonly (with states) record fields for which the user has no access write.
It is a little bit more work but the experience for the user will be
better

Thanks !
Done with this code and applied to all my fields:

_STATES = {
    'readonly': ((Eval('state') != 'draft') | (Eval('_user') != Eval('create_uid'))),
}

 

[Ryan]

Can these apply also for a set of groups?

[Cédric Krier]

On 2016-10-04 23:38, Ryan wrote:
> Can these apply also for a set of groups?

I do not recommend to add rules in the code indeed you could do it by
create record or field access.
http://doc.tryton.org/4.0/trytond/doc/topics/access_rights.html#topics-access-rights