Repository navigation
Conversation
Building and dispatching a tool reads ir.model via model_id, which a plain internal user (base.group_user) cannot access. Resolve the model name with sudo() while keeping the actual tool execution under the caller's own permissions, so non-admin MCP keys can list and call tools. Add a regression test exercising a non-admin user through _get_tool_definition and _execute_tool. (cherry picked from commit 16beaa7)
'date' is not a JSON Schema type, so the declared output schema is not valid for MCP clients validating against it. Declare the RFC 3339 format instead. Assisted-by: Devin:SWE-2 High
This was referenced Oct 7, 2026
dreispt
added a commit
to dreispt/ai
that referenced
this pull request
Oct 7, 2026
Port ai_tool_read from OCA#122 to 19.0. - Manifest version bump. - user_has_groups() removed: use res.users.has_groups(). - check_access_rights() deprecated since 18.0: use has_access() / check_access(). - View xpath targets use <list> instead of <tree>. - display_name is never stored in 19.0, so it is excluded everywhere; adjust test_display_name_hidden. - Replace setup/ symlink dir with the whool pyproject.toml convention. Requires the ai_tool fixes from OCA#125, cherry-picked in the preceding commits (ir.model is not readable by internal users in 19.0). Assisted-by: Devin:SWE-2 High
dreispt
added a commit
to dreispt/ai
that referenced
this pull request
Oct 7, 2026
Port ai_tool_read from OCA#122 to 19.0. - Manifest version bump. - user_has_groups() removed: use res.users.has_groups(). - check_access_rights() deprecated since 18.0: use has_access() / check_access(). - View xpath targets use <list> instead of <tree>. - display_name is never stored in 19.0, so it is excluded everywhere; adjust test_display_name_hidden. - Replace setup/ symlink dir with the whool pyproject.toml convention. Requires the ai_tool fixes from OCA#125, cherry-picked in the preceding commits (ir.model is not readable by internal users in 19.0). Assisted-by: Devin:SWE-2 High
nobuQuartile
approved these changes
Oct 7, 2026
nobuQuartile
left a comment
nobuQuartile
left a comment
There was a problem hiding this comment.
Thank you for recreating PR!
LGTM!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #119.
Two fixes needed for
ai_toolto be usable by non-admin users and MCP clients on 19.0:[FIX] ai_tool: resolve tool model metadata with sudo— cherry-picked from [19.0][FIX] ai_tool: date output schema and tool model metadata access #119 preserving @nobuQuartile's authorship. Since 19.0,ir.modelis no longer readable by internal users (base.group_usergetsperm_read=0), so_get_tool_definitionand_execute_toolraised AccessError for non-admin callers — e.g.ai_oca_mcpkeys bound to internal users. Their.modelname lookup is resolved viasudo(); the tool still executes with the caller's own permissions.[FIX] ai_tool: _ai_get_date declares an invalid JSON Schema type— equivalent to [19.0][FIX] ai_tool: date output schema and tool model metadata access #119's second commit, re-implemented because that commit is authored by a bot account (zachdreambot), which cannot pass the OCA CLA check.dateis not a JSON Schema type; the RFC 3339{"type": "string", "format": "date"}declaration is what MCP clients expect.