diff --git a/access_superuser/README.rst b/access_superuser/README.rst new file mode 100644 index 00000000..531ae239 --- /dev/null +++ b/access_superuser/README.rst @@ -0,0 +1,12 @@ +Access Superuser +================ + +In Superuser mode a User can control - who is eligible to become a Superuser. +Candidate User should have Administration: Settings + +Typical usage of the module. +---------------------------- + +On Preference tab of user settings there is new field - Is Sudoer. + +Tested on `Odoo 14.0 `_ diff --git a/access_superuser/__init__.py b/access_superuser/__init__.py new file mode 100644 index 00000000..f7209b17 --- /dev/null +++ b/access_superuser/__init__.py @@ -0,0 +1,2 @@ +from . import models +from . import controllers diff --git a/access_superuser/__manifest__.py b/access_superuser/__manifest__.py new file mode 100644 index 00000000..db7a1ba5 --- /dev/null +++ b/access_superuser/__manifest__.py @@ -0,0 +1,17 @@ +{ + "name": "Controllable Becoming a Superuser", + "summary": "Not any Admin can become a Superuser - there is new setting now allowing that", + "version": "14.0.0.0.1", + "author": "IT-Projects LLC, Ildar Nasyrov", + "category": "Extra Tools", + "images": ["images/banner.jpg"], + "support": "apps@itpp.dev", + "website": "https://twitter.com/OdooFree", + "license": "Other OSI approved licence", # MIT + "currency": "EUR", + "depends": [], + "data": [ + "views/res_users_views.xml", + ], + "installable": True, +} diff --git a/access_superuser/controllers/__init__.py b/access_superuser/controllers/__init__.py new file mode 100644 index 00000000..12a7e529 --- /dev/null +++ b/access_superuser/controllers/__init__.py @@ -0,0 +1 @@ +from . import main diff --git a/access_superuser/controllers/main.py b/access_superuser/controllers/main.py new file mode 100644 index 00000000..c59a5a7d --- /dev/null +++ b/access_superuser/controllers/main.py @@ -0,0 +1,13 @@ +from odoo import http +from odoo.addons.web.controllers.main import Home +from odoo.http import request + + +class Home(Home): + @http.route() + def switch_to_admin(self): + uid = request.env.user.id + if request.env.user.is_sudoer: + return super(Home, self).switch_to_admin() + else: + return http.local_redirect(self._login_redirect(uid), keep_hash=True) diff --git a/access_superuser/models/__init__.py b/access_superuser/models/__init__.py new file mode 100644 index 00000000..88351653 --- /dev/null +++ b/access_superuser/models/__init__.py @@ -0,0 +1 @@ +from . import res_users diff --git a/access_superuser/models/res_users.py b/access_superuser/models/res_users.py new file mode 100644 index 00000000..2bd3f64d --- /dev/null +++ b/access_superuser/models/res_users.py @@ -0,0 +1,59 @@ +from odoo import fields, models +from odoo.exceptions import UserError +from odoo.tools.translate import _ + + +class Users(models.Model): + _inherit = "res.users" + + is_sudoer = fields.Boolean( + default=True, + help=""" +Is a User eligible to become a Superuser. If True and User is Admin (Administrator: Settings) - then ok""", + ) + + def write(self, vals): + """ + if writing True in is_sudoer + check if system user + then let it pass or raise user error + """ + + if "is_sudoer" in vals and vals["is_sudoer"]: + if self.env.is_superuser() and self._is_system(): + pass + else: + raise UserError( + _( + """ + Insufficient rights for making someone a Sudoer + (You yourself should be in Superuser mode) + or this User is not a System User + (Administration: Settings)!""" + ) + ) + + if "is_sudoer" in vals and not vals["is_sudoer"]: + if self.env.is_superuser(): + raise UserError( + _( + """ + To clear 'Is Sudoer' setting - + please exit from Superuser mode, + this way the System can + check that you are not trying to do it + on your own, which is prohibited + because someone should be a sudoer""" + ) + ) + elif self == self.env.user: + raise UserError( + _( + """ + You cannot uncheck 'Is Sudoer' setting on yourself - + this prevents the situation when no one is + eligible becoming Superuser""" + ) + ) + + return super(Users, self).write(vals) diff --git a/access_superuser/views/res_users_views.xml b/access_superuser/views/res_users_views.xml new file mode 100644 index 00000000..7ad2b41e --- /dev/null +++ b/access_superuser/views/res_users_views.xml @@ -0,0 +1,15 @@ + + + + res.users.form.inheirt.sudoer.preference + res.users + + + + + + + + + +