Mercurial > hgweb > health
changeset 5656:e8e09f114875
task #16294: Harden access control to key patient models. Add default access to health_imaging models
| author | Luis Falcon <falcon@gnuhealth.org> |
|---|---|
| date | Sun, 15 Jan 2023 17:28:22 +0000 |
| parents | 351b2695d905 |
| children | dcd3f5817f73 |
| files | tryton/health_imaging/security/access_rights.xml tryton/health_imaging/tryton.cfg |
| diffstat | 2 files changed, 202 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
new file mode 100644 --- /dev/null +++ b/tryton/health_imaging/security/access_rights.xml @@ -0,0 +1,201 @@ +<?xml version="1.0" encoding="utf-8"?> + +<!-- +SPDX-FileCopyrightText: 2008-2023 Luis Falcón <falcon@gnuhealth.org> +SPDX-FileCopyrightText: 2011-2023 GNU Solidario <health@gnusolidario.org> + +SPDX-License-Identifier: GPL-3.0-or-later +--> + +<!-- This file is part of GNU Health. GPL v3+ --> +<!-- Luis Falcon . GNU Solidario --> +<!-- Default template for permission groups --> + +<tryton> + <data> + +<!-- Default access rights to models --> + + <record model="ir.model.access" id="access_health_imaging_test_type"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.type')]"/> + <field name="perm_read" eval="False"/> + <field name="perm_write" eval="False"/> + <field name="perm_create" eval="False"/> + <field name="perm_delete" eval="False"/> + </record> + + + <record model="ir.model.access" id="access_health_imaging_test"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test')]"/> + <field name="perm_read" eval="False"/> + <field name="perm_write" eval="False"/> + <field name="perm_create" eval="False"/> + <field name="perm_delete" eval="False"/> + </record> + + <record model="ir.model.access" id="access_health_imaging_test_request"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.request')]"/> + <field name="perm_read" eval="False"/> + <field name="perm_write" eval="False"/> + <field name="perm_create" eval="False"/> + <field name="perm_delete" eval="False"/> + </record> + + <record model="ir.model.access" id="access_health_imaging_test_result"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.result')]"/> + <field name="perm_read" eval="False"/> + <field name="perm_write" eval="False"/> + <field name="perm_create" eval="False"/> + <field name="perm_delete" eval="False"/> + </record> + +<!-- END OF DEFAULT ACCESS RIGHTS --> + +<!-- BEGIN imaging ADMINISTRATION GROUP ACCESS RIGHTS --> + +<!-- Create the Health imaging Administration group --> + <record model="res.group" id="group_health_imaging_admin"> + <field name="name">Health imaging Administration</field> + </record> + +<!-- Create the Health imaging group --> + <record model="res.group" id="group_health_imaging"> + <field name="name">Health imaging</field> + </record> + +<!-- Assign the Group to the "admin" user --> + + <record model="res.user-res.group" id="user_admin_group_health_imaging"> + <field name="user" ref="res.user_admin"/> + <field name="group" ref="group_health_imaging_admin"/> + </record> + + <!-- Access to Menus --> + + <record model="ir.ui.menu-res.group" id="menu_health_group_health_imaging_admin"> + <field name="menu" ref="menu_imaging"/> + <field name="group" ref="group_health_imaging_admin"/> + </record> + + <record model="ir.ui.menu-res.group" id="menu_health_group_health_imaging_conf_admin"> + <field name="menu" ref="menu_imaging_test_parent"/> + <field name="group" ref="group_health_imaging_admin"/> + </record> + + + <record model="ir.model.access" id="access_health_imaging_test_type_admin"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.type')]"/> + <field name="group" ref="group_health_imaging_admin"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_delete" eval="True"/> + </record> + + + <record model="ir.model.access" id="access_health_imaging_test_admin"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test')]"/> + <field name="group" ref="group_health_imaging_admin"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_delete" eval="True"/> + </record> + + <record model="ir.model.access" id="access_health_imaging_test_request_admin"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.request')]"/> + <field name="group" ref="group_health_imaging_admin"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_delete" eval="True"/> + </record> + + <record model="ir.model.access" id="access_health_imaging_test_result_admin"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.result')]"/> + <field name="group" ref="group_health_imaging_admin"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_delete" eval="False"/> + </record> + + +<!-- BEGIN imaging USER GROUP ACCESS RIGHTS --> + +<!-- Create the demo_imaging user --> + <record model="res.user" id="user_demo_imaging"> + <field name="name">Health imaging</field> + <field name="login">demo_imaging</field> + <field name="password">gnusolidario</field> + <field name="active" eval="False"></field> + </record> + +<!-- Assign the Group to the "admin" user --> + + <record model="res.user-res.group" id="user_admin_group_health_imaging_admin"> + <field name="user" ref="res.user_admin"/> + <field name="group" ref="group_health_imaging_admin"/> + </record> + +<!-- Assign the Admin group to the "demo_imaging" user --> + + <record model="res.user-res.group" id="user_demo_group_health_imaging"> + <field name="user" ref="user_demo_imaging"/> + <field name="group" ref="group_health_imaging_admin"/> + </record> + +<!-- Access to Menus --> + + <record model="ir.ui.menu-res.group" id="menu_health_group_health_imaging"> + <field name="menu" ref="health.gnuhealth_menu"/> + <field name="group" ref="group_health_imaging"/> + </record> + <record model="ir.ui.menu-res.group" id="menu_imaging_group_health_imaging"> + <field name="menu" ref="menu_imaging_test_parent"/> + <field name="group" ref="group_health_imaging"/> + </record> + + +<!-- DOCTOR --> + + <record model="ir.model.access" id="access_health_imaging_test_request_doctor"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.request')]"/> + <field name="group" ref="health.group_health_doctor"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_delete" eval="True"/> + </record> + + <record model="ir.model.access" id="access_health_imaging_result_doctor"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.result')]"/> + <field name="group" ref="health.group_health_doctor"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="True"/> + <field name="perm_create" eval="True"/> + <field name="perm_delete" eval="False"/> + </record> + + <record model="ir.model.access" id="access_health_imaging_test_doctor"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test')]"/> + <field name="group" ref="health.group_health_doctor"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="False"/> + <field name="perm_create" eval="False"/> + <field name="perm_delete" eval="False"/> + </record> + + <record model="ir.model.access" id="access_health_imaging_test_type_doctor"> + <field name="model" search="[('model', '=', 'gnuhealth.imaging.test.type')]"/> + <field name="group" ref="health.group_health_doctor"/> + <field name="perm_read" eval="True"/> + <field name="perm_write" eval="False"/> + <field name="perm_create" eval="False"/> + <field name="perm_delete" eval="False"/> + </record> + +<!-- END OF imaging GROUP ACCESS RIGHTS --> + + </data> +</tryton>
