runbot/runbot/security/runbot_security.xml
Xavier-Do 7cdf77ce18 [IMP] runbot: hide some buttons
Force new batch buttons can be sometimes confusing for user.
Creating a group to show this button for advanced user only will help
avoiding useless new batch when it's not needed.

New batch is only needed:
- to create a new slot when a new trigger is added/modified through a
custom trigger
- take last databases into account for upgrades, mainly when backporting
a new field or strange usually forbiden operations
- avoiding to need to push again to rebase when a r+ was added on one
pr but one of them needs to be rebased or adapted.

Thos case are unusuall but the button is used most of the time thinking
this is a kind or rebuild or maybe it will rebase and push the branch
on the pr. Only user with basic knowledge of when it is needed should
have access to these buttons.
2022-11-29 16:07:34 +01:00

135 lines
5.9 KiB
XML

<?xml version="1.0" encoding="utf-8"?>
<odoo>
<data>
<record model="ir.module.category" id="module_project">
<field name="name">Runbot</field>
</record>
<record id="group_user" model="res.groups">
<field name="name">User</field>
<field name="category_id" ref="module_project"/>
<!-- as public user is inactive, it wont be automatically added
to this group via implied groups. add it manually -->
<field name="users" eval="[(4, ref('base.public_user'))]"/>
</record>
<record id="base.group_public" model="res.groups">
<field name="implied_ids" eval="[(4, ref('runbot.group_user'))]"/>
</record>
<record id="base.group_user" model="res.groups">
<field name="implied_ids" eval="[(4, ref('runbot.group_user'))]"/>
</record>
<record id="base.group_portal" model="res.groups">
<field name="implied_ids" eval="[(4, ref('runbot.group_user'))]"/>
</record>
<record model="ir.module.category" id="build_config_project">
<field name="name">Build Config</field>
</record>
<record id="group_build_config_user" model="res.groups">
<field name="name">Build config user</field>
<field name="category_id" ref="build_config_project"/>
</record>
<record id="group_build_config_manager" model="res.groups">
<field name="name">Build config manager</field>
<field name="category_id" ref="build_config_project"/>
<field name="implied_ids" eval="[(4, ref('runbot.group_build_config_user'))]"/>
</record>
<record id="group_build_config_administrator" model="res.groups">
<field name="name">Build config administrator</field>
<field name="category_id" ref="build_config_project"/>
<field name="implied_ids" eval="[(4, ref('runbot.group_build_config_manager'))]"/>
<field name="users" eval="[(4, ref('base.user_root'))]"/>
</record>
<record id="group_runbot_error_manager" model="res.groups">
<field name="name">Build error manager</field>
<field name="category_id" ref="module_project"/>
</record>
<record id="group_runbot_team_manager" model="res.groups">
<field name="name">Team manager</field>
<field name="category_id" ref="module_project"/>
</record>
<record id="group_runbot_advanced_user" model="res.groups">
<field name="name">Advanced runbot user</field>
<field name="category_id" ref="module_project"/>
</record>
<record id="group_runbot_admin" model="res.groups">
<field name="name">Runbot administrator</field>
<field name="category_id" ref="module_project"/>
<field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
<field name="implied_ids" eval="[(4, ref('runbot.group_runbot_advanced_user')), (4, ref('runbot.group_user')), (4, ref('runbot.group_build_config_administrator'))]"/>
</record>
<!-- config access rules-->
<record id="runbot_build_config_access_administrator" model="ir.rule">
<field name="name">All config can be edited by config admin</field>
<field name="groups" eval="[(4, ref('group_build_config_administrator'))]"/>
<field name="model_id" ref="model_runbot_build_config"/>
<field name="domain_force">[(1, '=', 1)]</field>
<field name="perm_write" eval="True"/>
<field name="perm_unlink" eval="True"/>
<field name="perm_read" eval="False"/>
<field name="perm_create" eval="False"/>
</record>
<record id="runbot_build_config_access_manager" model="ir.rule">
<field name="name">Own config can be edited by user</field>
<field name="groups" eval="[(4, ref('group_build_config_manager'))]"/>
<field name="model_id" ref="model_runbot_build_config"/>
<field name="domain_force">[('protected', '=', False)]</field>
<field name="perm_write" eval="True"/>
<field name="perm_unlink" eval="True"/>
<field name="perm_read" eval="False"/>
<field name="perm_create" eval="True"/>
</record>
<record id="runbot_build_config_access_user" model="ir.rule">
<field name="name">All config can be edited by config admin</field>
<field name="groups" eval="[(4, ref('group_build_config_user'))]"/>
<field name="model_id" ref="model_runbot_build_config"/>
<field name="domain_force">[('create_uid', '=', user.id)]</field>
<field name="perm_write" eval="True"/>
<field name="perm_unlink" eval="True"/>
<field name="perm_read" eval="False"/>
<field name="perm_create" eval="True"/>
</record>
<!-- step access rules-->
<record id="runbot_build_config_step_access_administrator" model="ir.rule">
<field name="name">All config step can be edited by config admin</field>
<field name="groups" eval="[(4, ref('group_build_config_administrator'))]"/>
<field name="model_id" ref="model_runbot_build_config_step"/>
<field name="domain_force">[(1, '=', 1)]</field>
<field name="perm_read" eval="False"/>
</record>
<record id="runbot_build_config_step_access_manager" model="ir.rule">
<field name="name">Unprotected config step can be edited by manager</field>
<field name="groups" eval="[(4, ref('group_build_config_manager'))]"/>
<field name="model_id" ref="model_runbot_build_config_step"/>
<field name="domain_force">[('protected', '=', False)]</field>
<field name="perm_read" eval="False"/>
</record>
<record id="runbot_build_config_step_access_user" model="ir.rule">
<field name="name">Own config step can be edited by user</field>
<field name="groups" eval="[(4, ref('group_build_config_user'))]"/>
<field name="model_id" ref="model_runbot_build_config_step"/>
<field name="domain_force">[('protected', '=', False), ('create_uid', '=', user.id)]</field>
<field name="perm_read" eval="False"/>
</record>
</data>
</odoo>