Multicompany - all companies are selectable for users with restricted company access

[Ferdinand]

a user has only access rights to one company, but all companies show up in all select fields for companies (because no access rul is set for res_company)

I tried to copy the usual
['|','|',('company_id','=',False),('company_id','child_of',[user.company_id.id]),('company_id.child_ids','child_of',[user.company_id.id])]
but this gives an error.

[DBR (OpenERP) (dbr-openerp)]

Hello Dr. Ferdinand,

From your bug specification,I see there is two problem specified.

First one related to : Access Right
It is Wishlist.[It will be consider as future roadmap]

Second one related to : Record rule
Would you please explain me which type of error you got at your side?

Thanks.

[Ferdinand (office-chricar)]

I think it was this

./osv/orm.py: _('Operation prohibited by access rules, or performed on an already deleted document (Operation: %s, Document type: %s).')

IMHO these 2 errors should be separated for user friendlyness to clarify things.
* Error - access prohibited
* Error - deleted document

I thing this happens if the current company does not match the company in user preferences.
I would expect:
Error : current selected company does not match company in preferences.

We should think of having a separate error message for each of the OR conditions.

It needs very high skills to handle unspecified error messages like this.

hope this helps

[DBR (OpenERP) (dbr-openerp)]

Thanks for reporting.

[Jay Vora (Serpent Consulting Services) (jayvora)]

Hello,

This is more an issue with record rule configuration.
Changing proper record rules would do for you.

Domain for record rules
['|','|',('company_id','=',False),('company_id','child_of',[user.company_id.id]),('company_id.child_ids','child_of',[user.company_id.id])]

Should be replaced by

['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]

Hope this helps.
Thanks.

[Jay Vora (Serpent Consulting Services) (jayvora)]

We are in the process to correct the workaround,either to keep this domain as intact or change it.
Thanks.

[Olivier Dony (Odoo) (odo-openerp)]

This is a bit off-topic, but we have reverted the change that was introduced a bit before the 6.0 release where the multi-company rules where extended to allow seeing also records from ancestor companies, not just descendant ones.
This is the behavior of the rule that you are quoting in your bug description. It was reverted here:
- 6.0: 4435 <email address hidden>
- trunk: 4463 <email address hidden>

As for your specific use case, note that using this kind of domain on the res.company object makes no sense, as the left operand 'company_id' relies on a 'company_id' field, which does not exist when the record _is_ a company.

[Ferdinand (office-chricar)]

@Olivier
"seeing also records from ancestor" - IMHO makes no economical / organisational sense.
If you want to do this , the user has to get explicit access rights to the company.

@Jay
Should be replaced by ... - does not work either, because res_company has not company_id.

So please advice how to configure correctly "User must only see assigned companies"

[Jay Vora (Serpent Consulting Services) (jayvora)]

Hello Dr. Ferdinand,

The replacement should work only for those objects which have company_id field with it.
For res_company,it should be id instead of company_id. Or possible, there is already a domain for action on company.

Thanks.

[Ferdinand (office-chricar)]

this rule on res_company
[('id','child_of',[user.company_id.id])]
produces
RuntimeError: maximum recursion depth exceeded
at login

[Jay Vora (Serpent Consulting Services) (jayvora)]

Hello Dr. Ferdinand,

You've got the right catch.
There is nothing defined for the filtering of companies itself.
We may need to find a workaround for search() of companies.

On the other hand : If I am not wrong, this has led us to a problem of limitation of record_rule that, we cannot define domains which contain any relational field(to itself, like parent_id) or ID in domain. This will cause max recursion.

However, this should be another bug.

Thanks.

[Vo Minh Thu (thu)]

Ferdinand, Jay,

We are working on letting the rule [('id','child_of',[user.company_id.id])] on res_company work as expected. The recursive behavior has already been removed. We have still concerns about the impact of the change and we are working to find if anything else could break. The changes are being made at the branch https://code.launchpad.net/~openerp-dev/openobject-server/6.0-bug-719406-empty-record-rules-vmt/+merge/51522

[Ferdinand (office-chricar)]

good to hear - will it go into 6.0.2 as markedin the Milestone
it's essential for Multicompany production

[Vo Minh Thu (thu)]

The branch mentioned in the last comment has been merged in trunk at revision 3361. Thanks for reporting the bug!

[Olivier Dony (Odoo) (odo-openerp)]

Yes, this has in fact been merged into 6.0 at revision 3354 <email address hidden> before being ported to trunk, so it will be part of 6.0.2 as indicated by the milestone.