TechnoLibre/bemade-addons
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Corrected access error for coaches attempting to view the patient record for a patient that was also on teams the coach did not have access to.

Browse source
This commit is contained in:
Denis Durepos 2025-08-22 06:03:49 -04:00
parent 6c096430d5
commit 736f7011a7
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
bemade_sports_clinic/security/sports_clinic_portal_rules.xml
View file

@ -73,6 +73,18 @@
<field name="domain_force">[(1, '=', 1)]</field>
</record>
<!-- Portal team coaches can read teams that share patients with their accessible teams -->
<record id="portal_team_coach_team_read_shared_patients" model="ir.rule">
<field name="name">Portal Team Coach Read Teams via Shared Patients</field>
<field name="model_id" ref="model_sports_team"/>
<field name="groups" eval="[(6, 0, [ref('bemade_sports_clinic.group_portal_team_coach')])]"/>
<field name="perm_create" eval="False"/>
<field name="perm_write" eval="False"/>
<field name="perm_read" eval="True"/>
<field name="perm_unlink" eval="False"/>
<field name="domain_force">[('patient_ids', 'in', user.partner_id.team_staff_rel_ids.mapped('team_id.patient_ids.id') or [0])]</field>
</record>
<!-- Portal users can access injury documents for their team's players -->
<record id="portal_injury_document_access" model="ir.rule">
<field name="name">Portal Access to Injury Documents</field>