6cfb9551b0
- Fix ACL test assumptions about browse() behavior * Update tests to check field-level access instead of browse().exists() * Correct test methodology for AccessError validation - Implement buddy method pattern for RPC security * Refactor all sudo()/api.model methods to use public/private pattern * Public methods perform access checks, private methods contain privileged ops * Prevents RPC privilege escalation vulnerabilities - Enhanced security architecture * Add comprehensive mail activity portal access rules * Strengthen partner access controls * Update controller method references to use secure public methods - Test suite improvements * Add extensive mail activity portal access tests * Update player removal tests to use public method interfaces * Improve test coverage for security scenarios - Security best practices enforcement * All privileged operations now encapsulated in private methods * Clear separation between public API and internal operations * Maintains functionality while securing RPC access Resolves RPC security vulnerabilities and establishes proper ACL enforcement patterns.
5.4 KiB
5.4 KiB
| 1 | id | name | model_id:id | group_id:id | perm_read | perm_write | perm_create | perm_unlink |
|---|---|---|---|---|---|---|---|---|
| 2 | access_patient_user | User Access for Patients | model_sports_patient | group_sports_clinic_user | 1 | 1 | 1 | 0 |
| 3 | access_patient_treatment_pro | Treatment Professional Access for Patients | model_sports_patient | group_sports_clinic_treatment_professional | 1 | 1 | 1 | 1 |
| 4 | access_patient_admin | Admin Access for Patients | model_sports_patient | group_sports_clinic_admin | 1 | 1 | 1 | 1 |
| 5 | access_patient_portal | Portal Access for Patients | model_sports_patient | base.group_portal | 1 | 1 | 1 | 0 |
| 6 | access_patient_portal_tp | Portal Treatment Professional Access for Patients | model_sports_patient | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |
| 7 | access_patient_portal_coach | Portal Coach Access for Patients | model_sports_patient | bemade_sports_clinic.group_portal_team_coach | 1 | 1 | 1 | 0 |
| 8 | access_patient_contact_user | User Access for Patient Contacts | model_sports_patient_contact | group_sports_clinic_user | 1 | 1 | 1 | 1 |
| 9 | access_patient_contact_portal_tp | Portal TP Access for Patient Contacts | model_sports_patient_contact | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |
| 10 | access_injury_treatment_pro | Treatment Professional Access for Injuries | model_sports_patient_injury | group_sports_clinic_treatment_professional | 1 | 1 | 1 | 1 |
| 11 | access_injury_portal | Portal Access for Injuries | model_sports_patient_injury | base.group_portal | 1 | 0 | 1 | 0 |
| 12 | access_injury_portal_tp | Portal Treatment Prof Access for Injuries | model_sports_patient_injury | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |
| 13 | access_team_user | User Access for Teams | model_sports_team | group_sports_clinic_user | 1 | 1 | 1 | 0 |
| 14 | access_team_admin | Admin Access for Teams | model_sports_team | group_sports_clinic_admin | 1 | 1 | 1 | 1 |
| 15 | access_team_portal | Portal Access for Teams | model_sports_team | base.group_portal | 1 | 0 | 0 | 0 |
| 16 | access_team_staff_user | User Access for Team Staff | model_sports_team_staff | group_sports_clinic_user | 1 | 1 | 1 | 1 |
| 17 | access_team_staff_portal | Portal Access for Team Staff | model_sports_team_staff | base.group_portal | 1 | 0 | 0 | 0 |
| 18 | access_team_staff_admin | Admin Access for Team Staff | model_sports_team_staff | group_sports_clinic_admin | 1 | 1 | 1 | 1 |
| 19 | access_treatment_note_user | User Access for Treatment Notes | model_sports_treatment_note | group_sports_clinic_user | 1 | 0 | 0 | 0 |
| 20 | access_treatment_note_treatment_pro | Treatment Professional Access for Treatment Notes | model_sports_treatment_note | group_sports_clinic_treatment_professional | 1 | 1 | 1 | 1 |
| 21 | access_treatment_note_portal | Portal Access for Treatment Notes | model_sports_treatment_note | base.group_portal | 1 | 0 | 0 | 0 |
| 22 | access_treatment_note_admin | Admin Access for Treatment Notes | model_sports_treatment_note | group_sports_clinic_admin | 1 | 1 | 1 | 1 |
| 23 | access_injury_document_user | User Access for Injury Documents | model_sports_injury_document | group_sports_clinic_user | 1 | 1 | 1 | 1 |
| 24 | access_injury_document_treatment_pro | Treatment Professional Access for Injury Documents | model_sports_injury_document | group_sports_clinic_treatment_professional | 1 | 1 | 1 | 1 |
| 25 | access_injury_document_portal | Portal Access for Injury Documents | model_sports_injury_document | base.group_portal | 1 | 0 | 0 | 0 |
| 26 | access_injury_document_portal_read | Portal Read Access for Injury Documents | model_sports_injury_document | bemade_sports_clinic.group_portal_team_coach | 1 | 0 | 0 | 0 |
| 27 | access_injury_document_admin | Admin Access for Injury Documents | model_sports_injury_document | group_sports_clinic_admin | 1 | 1 | 1 | 1 |
| 28 | access_mail_activity_type_portal_tp | Portal TP Access for Activity Types | mail.model_mail_activity_type | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 29 | access_mail_activity_portal_tp | Portal TP Access for Activities | mail.model_mail_activity | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 1 |
| 30 | access_mail_alias_domain_portal_tp | Portal TP Access for Alias Domains | mail.model_mail_alias_domain | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 31 | access_mail_alias_portal_tp | Portal TP Access for Aliases | mail.model_mail_alias | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 32 | access_ir_model_portal_tp | Portal TP Access for Models | base.model_ir_model | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 33 | access_mail_message_subtype_portal_tp | Portal TP Access for Message Subtypes | mail.model_mail_message_subtype | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 34 | access_mail_template_portal_tp | Portal TP Access for Mail Templates | mail.model_mail_template | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 35 | access_mail_notification_portal_tp | Portal TP Access for Mail Notifications | mail.model_mail_notification | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |
| 36 | access_mail_message_portal_tp | Portal TP Access for Mail Messages | mail.model_mail_message | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |
| 37 | access_ir_attachment_portal_tp | Portal TP Access for Attachments | base.model_ir_attachment | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |
| 38 | access_res_users_portal_tp | Portal TP Access for Users | base.model_res_users | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 39 | access_res_partner_portal_tp | Portal TP Access for Partners | base.model_res_partner | bemade_sports_clinic.group_portal_treatment_professional | 1 | 0 | 0 | 0 |
| 40 | access_mail_followers_portal_tp | Portal TP Access for Followers | mail.model_mail_followers | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |
| 41 | access_bus_bus_portal_tp | Portal TP Access for Bus Messages | bus.model_bus_bus | bemade_sports_clinic.group_portal_treatment_professional | 1 | 1 | 1 | 0 |