a6742c16b0
- Fix has_group() security violations by using request.env.user.has_group() in controllers - Add mail.compose.message ACL permissions for portal users to enable injury creation - Fix foreign key constraint violation in treatment note creation by passing correct patient parameter - Update portal field labels and values to match internal views (match_status, practice_status, stage) - Change "Medical Notes" to "Team Notes" and convert from HTML to plain text rendering - Fix allergies field clearing logic to allow empty string updates - Improve badge text readability with proper color contrast across all portal views - Remove redundant external link icons from injury count displays Resolves portal injury creation 403 errors and ensures consistent terminology between portal and backend interfaces.
113 lines
5.8 KiB
XML
113 lines
5.8 KiB
XML
<?xml version="1.0" encoding="UTF-8" ?>
|
|
<odoo>
|
|
<data noupdate="1">
|
|
<!-- Refuse access to patient records that are not part of staff user's teams -->
|
|
<record id="restrict_staff_access_to_team_players" model="ir.rule">
|
|
<field name="name">Restrict Team Staff Access to Their Players Only</field>
|
|
<field name="model_id" ref="model_sports_patient"/>
|
|
<field name="groups"
|
|
eval="[(6, 0, [ref('base.group_portal'), ref('base.group_user'), ref('group_sports_clinic_treatment_professional')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[('team_ids.staff_ids.user_ids', 'in', user.id)]
|
|
</field>
|
|
</record>
|
|
<record id="restrict_staff_access_to_teams" model="ir.rule">
|
|
<field name="name">Restrict Team Staff Access to Their Teams Only</field>
|
|
<field name="model_id" ref="model_sports_team"/>
|
|
<field name="groups"
|
|
eval="[(6, 0, [ref('base.group_portal'), ref('base.group_user'), ref('group_sports_clinic_treatment_professional')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[('staff_ids.user_ids', 'in', user.id)]
|
|
</field>
|
|
</record>
|
|
<record id="restrict_staff_access_to_team_injuries" model="ir.rule">
|
|
<field name="name">Restrict Team Staff Access to Their Teams Only</field>
|
|
<field name="model_id" ref="model_sports_patient_injury"/>
|
|
<field name="groups"
|
|
eval="[(6, 0, [ref('base.group_portal'), ref('base.group_user'), ref('group_sports_clinic_treatment_professional')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[('patient_id.team_ids.staff_ids.user_ids', 'in', user.id)]
|
|
</field>
|
|
</record>
|
|
<record id="restrict_patient_contact_access_to_allowed_internal_users"
|
|
model="ir.rule">
|
|
<field name="name">Restrict Patient Contact Access to Allowed Internal
|
|
Users
|
|
</field>
|
|
<field name="model_id" ref="model_sports_patient_contact"/>
|
|
<field name="groups" eval="[(6, 0, [ref('base.group_user'), ref('group_sports_clinic_treatment_professional')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[('patient_id.team_ids.staff_ids.user_ids', 'in', user.id)]
|
|
</field>
|
|
</record>
|
|
<record id="allow_team_access_to_admins" model="ir.rule">
|
|
<field name="name">Allow Team Access to Administrators</field>
|
|
<field name="model_id" ref="model_sports_team"/>
|
|
<field name="groups"
|
|
eval="[(6, 0, [ref('base.group_system'), ref('bemade_sports_clinic.group_sports_clinic_admin')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[(1, '=', 1)]
|
|
</field>
|
|
</record>
|
|
<record id="allow_patient_access_to_admins" model="ir.rule">
|
|
<field name="name">Allow Patient Access to Administrators</field>
|
|
<field name="model_id" ref="model_sports_patient"/>
|
|
<field name="groups"
|
|
eval="[(6, 0, [ref('base.group_system'), ref('bemade_sports_clinic.group_sports_clinic_admin')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[(1, '=', 1)]
|
|
</field>
|
|
</record>
|
|
<record id="allow_injury_access_to_admins" model="ir.rule">
|
|
<field name="name">Allow Injury Access to Administrators</field>
|
|
<field name="model_id" ref="model_sports_patient_injury"/>
|
|
<field name="groups"
|
|
eval="[(6, 0, [ref('base.group_system'), ref('bemade_sports_clinic.group_sports_clinic_admin')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[(1, '=', 1)]
|
|
</field>
|
|
</record>
|
|
<record id="allow_patient_contact_access_to_admins" model="ir.rule">
|
|
<field name="name">Allow Sports Patient Contact Access to Administrators
|
|
</field>
|
|
<field name="model_id" ref="model_sports_patient_contact"/>
|
|
<field name="groups"
|
|
eval="[(6, 0, [ref('base.group_system'), ref('bemade_sports_clinic.group_sports_clinic_admin')])]"/>
|
|
<field name="perm_create" eval="True"/>
|
|
<field name="perm_write" eval="True"/>
|
|
<field name="perm_read" eval="True"/>
|
|
<field name="perm_unlink" eval="True"/>
|
|
<field name="domain_force">
|
|
[(1, '=', 1)]
|
|
</field>
|
|
</record>
|
|
</data>
|
|
</odoo>
|