From afa4a2017697763e13517bc99c286d66bed02c90 Mon Sep 17 00:00:00 2001 From: Sergi Almacellas Abellana Date: Thu, 23 Nov 2023 15:04:06 +0100 Subject: [PATCH] Make record rules documentation more explicit --- trytond/doc/topics/access_rights.rst | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/trytond/doc/topics/access_rights.rst b/trytond/doc/topics/access_rights.rst index 201a385c64..75fd52a37c 100644 --- a/trytond/doc/topics/access_rights.rst +++ b/trytond/doc/topics/access_rights.rst @@ -82,17 +82,20 @@ The record rules are conditions that records must meet for the user to be granted permission to use them. They are defined by records of ``ir.rule.group`` which contains: - - a model on which it applies - - the permissions granted - - a set of user groups to which the rule applies - - a global flag to always enforce - - a default flag to add to all users - - a list of ``ir.rule`` with a :ref:`domain ` to select the - records to which the rule applies. + - The model the rule applies to. + - The type of permissions to be granted. + - A set of user groups to which the rule applies. + - A global flag to always enforce the rule even if there are other rules + that are less restrictive. + - A default flag to apply the rule, by default, to all users. + This then allows other less restrictive rules, that apply to the user, + to grant them additional permissions. + - A list of ``ir.rule`` records, each with a :ref:`domain ` + that is used to select the records to which the rule applies. A rule group matches a record if the record is validated by at least one of the domains. -The access is granted to a record: +Access is only granted to a record: - if the user belongs to a group which has at least one matching rule group that has the permission, @@ -101,7 +104,9 @@ The access is granted to a record: - or if there is a global matching rule group with the permission. -Otherwise the access is denied if there is any matching rule group. + - or if there are no matching rule groups and no global rule groups for + the model. + .. note:: Records for which the user has no ``read`` access are filtered out from the