Restrict the lines that can be remove it from a many2many field

[Luciano Rossi]

Hi!

I need to create an interface to manage the users. For now, I add to my
module the menu item Administration -> Users.

The problem that i'm having, is that I want to restrict the groups that
the user can add or remove from the groups field (many2many).

I added a restriction to the groups field, modifying the definition of
the domain attribute of the groups field, so when choosing the groups to
be added, it will restrict the list of them. But, I don't know how I can
restrict the lines (groups) that the user can remove.

For example, the user can add to the user the groups Accounts and
Purchase. But, if the user already has the group Sale, I do not want
that this group to be remove it.

Any idea?

Thanks!
--
Luciano Rossi - lu...@gcoop.coop
http://gcoop.coop - Cooperativa de Software Libre
Julián Alvarez 958 CABA C1414DRT +54 11 4771-0055

Visitá www.tiendas.coop - www.nube.coop

[Sergi Almacellas Abellana]

El 25/01/18 a les 15:24, Luciano Rossi ha escrit:

> Hi!
>
> I need to create an interface to manage the users. For now, I add to my
> module the menu item Administration -> Users.
>
> The problem that i'm having, is that I want to restrict the groups that
> the user can add or remove from the groups field (many2many).
>
> I added a restriction to the groups field, modifying the definition of
> the domain attribute of the groups field, so when choosing the groups to
> be added, it will restrict the list of them. But, I don't know how I can
> restrict the lines (groups) that the user can remove.

The user will be allowed to add and remove all the groups that are
allowed by domain.

>
> For example, the user can add to the user the groups Accounts and
> Purchase. But, if the user already has the group Sale, I do not want
> that this group to be remove it.
>
> Any idea?

If the idea is to prevent removal of existing groups I will probably
make the current user groups readonly and add a function field which is
empty by default and it's used to add new groups to the user.

But for sure, this should be done with access groups, so there are
groups that are allowed to write directly and remove groups.

Hope it helps.

--
Sergi Almacellas Abellana
www.koolpi.com
Twitter: @pokoli_srk

[Luciano Rossi]

Hi sergi!

El 25/01/18 a las 11:57, Sergi Almacellas Abellana escribió:

> El 25/01/18 a les 15:24, Luciano Rossi ha escrit:
>> Hi!
>>
>> I need to create an interface to manage the users. For now, I add to my
>> module the menu item Administration -> Users.
>>
>> The problem that i'm having, is that I want to restrict the groups that
>> the user can add or remove from the groups field (many2many).
>>
>> I added a restriction to the groups field, modifying the definition of
>> the domain attribute of the groups field, so when choosing the groups to
>> be added, it will restrict the list of them. But, I don't know how I can
>> restrict the lines (groups) that the user can remove.
>
> The user will be allowed to add and remove all the groups that are
> allowed by domain.
>
>>
>> For example, the user can add to the user the groups Accounts and
>> Purchase. But, if the user already has the group Sale, I do not want
>> that this group to be remove it.
>>
>> Any idea?
>
> If the idea is to prevent removal of existing groups I will probably
> make the current user groups readonly and add a function field which is
> empty by default and it's used to add new groups to the user.
>

It's a good idea. Perhaps the function field should not be empty. May
be, it could retrieve only the groups that the user has, but that are
allowed to add or remove it.

> But for sure, this should be done with access groups, so there are
> groups that are allowed to write directly and remove groups.
>

If I understand, yes, this new "group" could not modify or remove the
groups, just add or remove it from the groups field at User model.

> Hope it helps.

[Sergi Almacellas Abellana]

El 25/01/18 a les 16:13, Luciano Rossi ha escrit:

>>
>> If the idea is to prevent removal of existing groups I will probably
>> make the current user groups readonly and add a function field which is
>> empty by default and it's used to add new groups to the user.
>>
>
> It's a good idea. Perhaps the function field should not be empty. May
> be, it could retrieve only the groups that the user has, but that are
> allowed to add or remove it.

If you can apply a domain to filter the group of records that the user
is allowed to write and modify, you can add a new Many2Many fields which
writes to the same relation but applying a filter on target records with
the filter attribute:

http://doc.tryton.org/4.6/trytond/doc/ref/models/fields.html?highlight=filter#trytond.model.fields.Many2Many.filter

[Cédric Krier]

On 2018-01-25 11:24, Luciano Rossi wrote:
> Hi!
>
> I need to create an interface to manage the users. For now, I add to my
> module the menu item Administration -> Users.
>
> The problem that i'm having, is that I want to restrict the groups that
> the user can add or remove from the groups field (many2many).
>
> I added a restriction to the groups field, modifying the definition of
> the domain attribute of the groups field, so when choosing the groups to
> be added, it will restrict the list of them. But, I don't know how I can
> restrict the lines (groups) that the user can remove.
>
> For example, the user can add to the user the groups Accounts and
> Purchase. But, if the user already has the group Sale, I do not want
> that this group to be remove it.
>
> Any idea?

For me, this is strange. If a user can add some groups to its profile, I
do not see why not add all the allowed to the user by default so he does
not need to edit himself this sensitive field. I see no reason a user
will want to remove himself from some groups and thus restrict himself
his access rights..

Maybe what you are looking for is an abstract level above the group to
ease the management. Sebastian has started to work on something like
that: https://bugs.tryton.org/issue7003

--
Cédric Krier - B2CK SPRL
Email/Jabber: cedric...@b2ck.com
Tel: +32 472 54 46 59
Website: http://www.b2ck.com/

[Cédric Krier]

I do not think such design will enforce any security.

[Luciano Rossi]

Hi Cédric,

El 25/01/18 a las 12:36, Cédric Krier escribió:

> On 2018-01-25 11:24, Luciano Rossi wrote:
>> Hi!
>>
>> I need to create an interface to manage the users. For now, I add to my
>> module the menu item Administration -> Users.
>>
>> The problem that i'm having, is that I want to restrict the groups that
>> the user can add or remove from the groups field (many2many).
>>
>> I added a restriction to the groups field, modifying the definition of
>> the domain attribute of the groups field, so when choosing the groups to
>> be added, it will restrict the list of them. But, I don't know how I can
>> restrict the lines (groups) that the user can remove.
>>
>> For example, the user can add to the user the groups Accounts and
>> Purchase. But, if the user already has the group Sale, I do not want
>> that this group to be remove it.
>>
>> Any idea?
>
> For me, this is strange. If a user can add some groups to its profile, I
> do not see why not add all the allowed to the user by default so he does
> not need to edit himself this sensitive field. I see no reason a user
> will want to remove himself from some groups and thus restrict himself
> his access rights..

Well, I think it's not strange if the idea is to sell Tryton as SAAS.
Probably you will want to give to the customer the possibility to create
or modify users, but for example, you will not want him to access to the
Administration group (if the customer grant access to that, it could
activate modules).

>
> Maybe what you are looking for is an abstract level above the group to
> ease the management. Sebastian has started to work on something like
> that: https://bugs.tryton.org/issue7003

mmm.. If I understand right, I will need to restrict also the roles that
the user could manage.

[Cédric Krier]

It is still strange for me even on SaaS.
I do not see any problem to allow user to *activate* modules as far as you
control the modules that are *installed*.