Odoo 13 record rules: Write access on specific records

Question

I'm working on a module extendig Odoo's Attendance. My goal is to make only records meeting a condition editable while others stay readonly.

I've created an additional field user_editable to imitate the future condition, but alas this does not work. All shown entries are set to readonly.

What am I missing?

These are my record rules adapted from existing ones.

<odoo>
    <record id="mymodule_attendance_rule_create" model="ir.rule">
        <field name="name">user: modify own attendance only</field>
        <field name="model_id" ref="hr_attendance.model_hr_attendance"/>
        <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
        <field name="perm_read" eval="0"/>
        <field name="perm_write" eval="0"/>
        <field name="perm_create" eval="1"/>
        <field name="perm_unlink" eval="0"/>
        <field name="groups" eval="[(4,ref('base.group_user'))]"/>
    </record>

    <record id="mymodule_attendance_rule_change" model="ir.rule">
        <field name="name">user: modify only last three workdays' attendance</field>
        <field name="model_id" ref="hr_attendance.model_hr_attendance"/>
        <field name="domain_force">[
            ('user_editable','=',True),
            ('employee_id.user_id','=',user.id)
            ]</field> 
        <field name="perm_read" eval="0"/>
        <field name="perm_write" eval="1"/>
        <field name="perm_create" eval="0"/>
        <field name="perm_unlink" eval="1"/>
        <field name="groups" eval="[(4,ref('base.group_user'))]"/>
    </record>
</odoo>

As far as I understand the second one should be evaluated when the user tries to edit an entry, which, however, is uneditable in frontend upon installing the module.

Here's a defitinion of my extra field:

class HrAttendance(models.Model):
    _inherit = "hr.attendance"

    user_editable = fields.Boolean(string='User editable',
                                    store=True,
                                    compute='_compute_user_editable')

_compute_user_editable currently just sets "True".

Thanks!

Answer 1

I've found the source of the problem. The views I was inheriting from were editable for members of the Officer and Administrator groups. This was achieved by setting a condition:

    <record id="view_attendance_tree_inherit" model="ir.ui.view">
        <field name="name">hr.attendance.tree.inherit</field>
        <field name="model">hr.attendance</field>
        <field name="inherit_id" ref="hr_attendance.view_attendance_tree"/>
        <!-- the line hier was causing the problem -->
        <field name="groups_id" eval="[(4, ref('hr_attendance.group_hr_attendance_user'))]"/>
        <field name="arch" type="xml">
            <tree position="attributes">
                <attribute name="edit">1</attribute>
                <attribute name="editable">bottom</attribute>
            </tree>
        </field>
    </record>

group_hr_attendance_user is in fact the Officer group. So anyone in Manual attendance group is not able to edit the records. This condition check forbids it.

So my approach was to just create an own view (basically an altered copy of this one) with a proper group check. group_hr_attendance is the Manual attendance group. And to make it work, I've added

    <field name="view_ids" eval="[(5, 0, 0),
                                    (0, 0, {'view_mode': 'tree', 'view_id': ref('mymodule.view_attendance_tree')}),
                                    (0, 0, {'view_mode': 'kanban', 'view_id': ref('hr_attendance.view_hr_attendance_kanban')}),
                                    (0, 0, {'view_mode': 'form', 'view_id': ref('mymodule.attendance_view_form')})]"/>

to my menu action. I've made a copy fo an attendance_view_form aswell, as it had the same group limitation as the tree view.