Repository navigation
[FIX] ni_medication: read donor dosage views with sudo - #180
Merged
Merged
Conversation
The dosage fields mixin splices fragments from donor form views in _get_view, which runs as the requesting user on a view-cache miss. Only base.group_system can read ir.ui.view, so medication users got an access error opening medication forms whenever no admin had loaded the form first in the same language (e.g. after a restart or upgrade). Tests now run as the lowest group each one needs, with the view cache cleared, so access regressions surface instead of being hidden by the superuser and the view cache. Fixes #178
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
ni.medication.dosage.fields.mixin._get_viewreads donor form views withsudo()before using theirarch.ni_medicationtests run as the lowest group each needs instead of the superuser:TestDosageFieldsMixin→ni_medication.group_viewer, with the registry cache cleared insetUpso_get_viewactually runs.TestDosageTiming→ni_medication.group_user(lowest group that can createni.medication.dosage).sudo()invariant for donor views.Why
Medication users could not open "เพิ่มประวัติการใช้ยา" (or the request/dispense/suggest line forms): Odoo raised an access error on
ir.ui.view, which onlybase.group_systemcan read. The mixin's_get_viewruns as the requesting user on a view-cache miss, so the error appeared after a restart/upgrade or in a language no admin had loaded the form in yet. The existing tests ran as superuser and could not catch it.Closes #178
Scope
ni_medication: forms ofni.medication.request,ni.medication.dispense,ni.medication.statement,ni.medication.suggest.line.Risk / Impact
Low.
sudo()only covers reading the shipped donor view arch; record access is unchanged. No migration or config needed. Deploy by updatingni_medication.How tested
TestDosageFieldsMixinsubtests fail with the sameir.ui.viewAccessError.ni.medication.statementform with caches cleared.Documentation
README.mdupdatedNotes for reviewer