diff --git a/technical_admin_limited/README.rst b/technical_admin_limited/README.rst new file mode 100644 index 0000000..fe2323e --- /dev/null +++ b/technical_admin_limited/README.rst @@ -0,0 +1,84 @@ +======================= +Technical Admin Limited +======================= + +.. + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! source digest: sha256:05681c8b95215bc67d045a7cd874f6d05785f42ba9743df5b54345f0a8863908 + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-Escodoo%2Fserver--addons-lightgray.png?logo=github + :target: https://github.com/Escodoo/server-addons/tree/18.0/technical_admin_limited + :alt: Escodoo/server-addons + +|badge1| |badge2| |badge3| + +This module creates a group to access to technical features without +access to business or sensitive company data. + +**Table of contents** + +.. contents:: + :local: + +Usage +===== + +Configuration +------------- + +The users that are in the group "Technical Administrator (Limited)" can +access the settings and technical menus but can't access purchase +orders, sales orders, account moves, employees or contracts. You must +remove the following permissions from the user: + +- Sales / Administrator +- Purchase / Administrator +- Invoicing / Administrator +- Employees / Administrator +- Contracts / Administrator + +Besides the restrictions in Sales, Purchase, Invoicing, Employees and +Contracts, the module makes users, groups and record rules read-only, +and restricts access to system parameters. + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +------- + +* Escodoo + +Contributors +------------ + +- ``Escodoo ``\ \_: + + - Wesley Oliveira wesley.oliveira@escodoo.com.br + +Maintainers +----------- + +This module is part of the `Escodoo/server-addons `_ project on GitHub. + +You are welcome to contribute. diff --git a/technical_admin_limited/__init__.py b/technical_admin_limited/__init__.py new file mode 100644 index 0000000..0650744 --- /dev/null +++ b/technical_admin_limited/__init__.py @@ -0,0 +1 @@ +from . import models diff --git a/technical_admin_limited/__manifest__.py b/technical_admin_limited/__manifest__.py new file mode 100644 index 0000000..29b571f --- /dev/null +++ b/technical_admin_limited/__manifest__.py @@ -0,0 +1,27 @@ +# Copyright 2026 - TODAY, Escodoo +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). + +{ + "name": "Technical Admin Limited", + "summary": """ + Access to technical features without + allowing access to sensitive company data""", + "version": "18.0.1.0.0", + "license": "AGPL-3", + "author": "Escodoo", + "website": "https://github.com/Escodoo/server-addons", + "depends": [ + "base", + "sale", + "purchase", + "account", + "hr", + "hr_contract", + ], + "data": [ + "security/res_groups.xml", + "security/ir.model.access.csv", + "data/record_rules.xml", + ], + "installable": True, +} diff --git a/technical_admin_limited/data/record_rules.xml b/technical_admin_limited/data/record_rules.xml new file mode 100644 index 0000000..ac3b571 --- /dev/null +++ b/technical_admin_limited/data/record_rules.xml @@ -0,0 +1,116 @@ + + + + + Block Sale Orders for Technical Admin + + + [('id', '=', False)] + + + + + + + + Block Sale Order Lines for Technical Admin + + + [('id', '=', False)] + + + + + + + + Block Purchase Orders for Technical Admin + + + [('id', '=', False)] + + + + + + + + Block Purchase Order Lines for Technical Admin + + + [('id', '=', False)] + + + + + + + + Block Account Moves for Technical Admin + + + [('id', '=', False)] + + + + + + + + Block Account Move Lines for Technical Admin + + + [('id', '=', False)] + + + + + + + + Block Employees for Technical Admin + + + [('id', '=', False)] + + + + + + + + Block Contracts for Technical Admin + + + [('id', '=', False)] + + + + + + diff --git a/technical_admin_limited/models/__init__.py b/technical_admin_limited/models/__init__.py new file mode 100644 index 0000000..56687a7 --- /dev/null +++ b/technical_admin_limited/models/__init__.py @@ -0,0 +1,4 @@ +from . import ir_rule +from . import ir_config_parameter +from . import res_groups +from . import res_users diff --git a/technical_admin_limited/models/ir_config_parameter.py b/technical_admin_limited/models/ir_config_parameter.py new file mode 100644 index 0000000..11ab114 --- /dev/null +++ b/technical_admin_limited/models/ir_config_parameter.py @@ -0,0 +1,44 @@ +from odoo import api, exceptions, models + + +class IrConfigParameter(models.Model): + _inherit = "ir.config_parameter" + + def _check_technical_admin_limited(self): + if self.env.user.has_group( + "technical_admin_limited.group_technical_admin_limited" + ): + raise exceptions.AccessError( + self.env._( + "You are not allowed to access System Parameters.\n\n" + "This action is restricted for Technical " + "Administrators (Limited)." + ) + ) + + @api.model + def web_search_read( + self, domain, specification, offset=0, limit=None, order=None, count_limit=None + ): + self._check_technical_admin_limited() + return super().web_search_read( + domain, + specification, + offset=offset, + limit=limit, + order=order, + count_limit=count_limit, + ) + + @api.model_create_multi + def create(self, vals_list): + self._check_technical_admin_limited() + return super().create(vals_list) + + def write(self, vals): + self._check_technical_admin_limited() + return super().write(vals) + + def unlink(self): + self._check_technical_admin_limited() + return super().unlink() diff --git a/technical_admin_limited/models/ir_rule.py b/technical_admin_limited/models/ir_rule.py new file mode 100644 index 0000000..1c567b1 --- /dev/null +++ b/technical_admin_limited/models/ir_rule.py @@ -0,0 +1,30 @@ +from odoo import api, exceptions, models + + +class IrRule(models.Model): + _inherit = "ir.rule" + + def _check_technical_admin_limited(self): + if self.env.user.has_group( + "technical_admin_limited.group_technical_admin_limited" + ): + raise exceptions.AccessError( + self.env._( + "You are not allowed to modify rules.\n\n" + "This action is restricted for Technical " + "Administrators (Limited)." + ) + ) + + @api.model_create_multi + def create(self, vals_list): + self._check_technical_admin_limited() + return super().create(vals_list) + + def write(self, vals): + self._check_technical_admin_limited() + return super().write(vals) + + def unlink(self): + self._check_technical_admin_limited() + return super().unlink() diff --git a/technical_admin_limited/models/res_groups.py b/technical_admin_limited/models/res_groups.py new file mode 100644 index 0000000..db1893b --- /dev/null +++ b/technical_admin_limited/models/res_groups.py @@ -0,0 +1,30 @@ +from odoo import api, exceptions, models + + +class ResGroups(models.Model): + _inherit = "res.groups" + + def _check_technical_admin_limited(self): + if self.env.user.has_group( + "technical_admin_limited.group_technical_admin_limited" + ): + raise exceptions.AccessError( + self.env._( + "You are not allowed to modify groups.\n\n" + "This action is restricted for Technical " + "Administrators (Limited)." + ) + ) + + @api.model_create_multi + def create(self, vals_list): + self._check_technical_admin_limited() + return super().create(vals_list) + + def write(self, vals): + self._check_technical_admin_limited() + return super().write(vals) + + def unlink(self): + self._check_technical_admin_limited() + return super().unlink() diff --git a/technical_admin_limited/models/res_users.py b/technical_admin_limited/models/res_users.py new file mode 100644 index 0000000..19bd283 --- /dev/null +++ b/technical_admin_limited/models/res_users.py @@ -0,0 +1,30 @@ +from odoo import api, exceptions, models + + +class ResUsers(models.Model): + _inherit = "res.users" + + def _check_technical_admin_limited(self): + if self.env.user.has_group( + "technical_admin_limited.group_technical_admin_limited" + ): + raise exceptions.AccessError( + self.env._( + "You are not allowed to modify users.\n\n" + "This action is restricted for Technical " + "Administrators (Limited)." + ) + ) + + @api.model_create_multi + def create(self, vals_list): + self._check_technical_admin_limited() + return super().create(vals_list) + + def write(self, vals): + self._check_technical_admin_limited() + return super().write(vals) + + def unlink(self): + self._check_technical_admin_limited() + return super().unlink() diff --git a/technical_admin_limited/pyproject.toml b/technical_admin_limited/pyproject.toml new file mode 100644 index 0000000..4231d0c --- /dev/null +++ b/technical_admin_limited/pyproject.toml @@ -0,0 +1,3 @@ +[build-system] +requires = ["whool"] +build-backend = "whool.buildapi" diff --git a/technical_admin_limited/readme/CONTRIBUTORS.md b/technical_admin_limited/readme/CONTRIBUTORS.md new file mode 100644 index 0000000..2f9bd6d --- /dev/null +++ b/technical_admin_limited/readme/CONTRIBUTORS.md @@ -0,0 +1,3 @@ +* `Escodoo `_: + + * Wesley Oliveira diff --git a/technical_admin_limited/readme/DESCRIPTION.md b/technical_admin_limited/readme/DESCRIPTION.md new file mode 100644 index 0000000..cb68e7e --- /dev/null +++ b/technical_admin_limited/readme/DESCRIPTION.md @@ -0,0 +1,2 @@ +This module creates a group to access to technical features +without access to business or sensitive company data. diff --git a/technical_admin_limited/readme/USAGE.md b/technical_admin_limited/readme/USAGE.md new file mode 100644 index 0000000..c228e04 --- /dev/null +++ b/technical_admin_limited/readme/USAGE.md @@ -0,0 +1,16 @@ +## Configuration + +The users that are in the group "Technical Administrator (Limited)" can access +the settings and technical menus but can't access purchase orders, sales orders, +account moves, employees or contracts. You must remove the following permissions +from the user: + +- Sales / Administrator +- Purchase / Administrator +- Invoicing / Administrator +- Employees / Administrator +- Contracts / Administrator + +Besides the restrictions in Sales, Purchase, Invoicing, Employees and Contracts, the +module makes users, groups and record rules read-only, and restricts access to system +parameters. diff --git a/technical_admin_limited/security/ir.model.access.csv b/technical_admin_limited/security/ir.model.access.csv new file mode 100644 index 0000000..71c927d --- /dev/null +++ b/technical_admin_limited/security/ir.model.access.csv @@ -0,0 +1,2 @@ +id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink +access_ir_model_technical_admin_limited,ir.model access technical admin limited,base.model_ir_model,technical_admin_limited.group_technical_admin_limited,1,0,0,0 diff --git a/technical_admin_limited/security/res_groups.xml b/technical_admin_limited/security/res_groups.xml new file mode 100644 index 0000000..6027000 --- /dev/null +++ b/technical_admin_limited/security/res_groups.xml @@ -0,0 +1,12 @@ + + + + Technical Administrator (Limited) + + + Technical administrators with access to settings and technical menus, + but without access to business or sensitive company data. + + + + diff --git a/technical_admin_limited/static/description/icon.png b/technical_admin_limited/static/description/icon.png new file mode 100644 index 0000000..3a0328b Binary files /dev/null and b/technical_admin_limited/static/description/icon.png differ diff --git a/technical_admin_limited/static/description/index.html b/technical_admin_limited/static/description/index.html new file mode 100644 index 0000000..d2b073d --- /dev/null +++ b/technical_admin_limited/static/description/index.html @@ -0,0 +1,444 @@ + + + + + +Technical Admin Limited + + + +
+

Technical Admin Limited

+ + +

Beta License: AGPL-3 Escodoo/server-addons

+

This module creates a group to access to technical features without +access to business or sensitive company data.

+

Table of contents

+ +
+

Usage

+
+

Configuration

+

The users that are in the group “Technical Administrator (Limited)” can +access the settings and technical menus but can’t access purchase +orders, sales orders, account moves, employees or contracts. You must +remove the following permissions from the user:

+
    +
  • Sales / Administrator
    • +
  • Purchase / Administrator
    • +
  • Invoicing / Administrator
    • +
  • Employees / Administrator
    • +
  • Contracts / Administrator
    • +
+

Besides the restrictions in Sales, Purchase, Invoicing, Employees and +Contracts, the module makes users, groups and record rules read-only, +and restricts access to system parameters.

+
+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us to smash it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • Escodoo
    • +
+
+
+

Contributors

+ +
+
+

Maintainers

+

This module is part of the Escodoo/server-addons project on GitHub.

+

You are welcome to contribute.

+
+
+
+ +