Restrict DCI sync and cached value access#234
Conversation
There was a problem hiding this comment.
Code Review
This pull request introduces access control restrictions for syncing DCI-backed CEL values. It disables default read access to spp.data.value for base users, restricts the sync action to CEL Domain Managers, and adds a permission check in sync_for_partners along with a corresponding unit test. Feedback on the changes suggests updating the access check in _check_dci_sync_access to bypass the group check when running in superuser mode (self.env.su), preventing unexpected AccessError exceptions during sudo() operations.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| def _check_dci_sync_access(self): | ||
| """Require CEL manager privileges before triggering outbound DCI sync.""" | ||
| if not self.env.user.has_group("spp_cel_domain.group_cel_domain_manager"): | ||
| raise AccessError(_("Only CEL Domain Managers can sync DCI-backed CEL values.")) |
There was a problem hiding this comment.
In Odoo, when a method is executed in superuser mode (e.g., via .sudo()), self.env.su is set to True, but self.env.user remains the original user. If the original user does not belong to the CEL manager group, calling self.env.user.has_group(...) will return False and raise an AccessError, even though the environment is running with elevated privileges. To ensure that sudo() works correctly and doesn't unexpectedly fail with an access error, you should explicitly bypass this check when self.env.su is True.
| def _check_dci_sync_access(self): | |
| """Require CEL manager privileges before triggering outbound DCI sync.""" | |
| if not self.env.user.has_group("spp_cel_domain.group_cel_domain_manager"): | |
| raise AccessError(_("Only CEL Domain Managers can sync DCI-backed CEL values.")) | |
| @api.model | |
| def _check_dci_sync_access(self): | |
| """Require CEL manager privileges before triggering outbound DCI sync.""" | |
| if not self.env.su and not self.env.user.has_group("spp_cel_domain.group_cel_domain_manager"): | |
| raise AccessError(_("Only CEL Domain Managers can sync DCI-backed CEL values.")) |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 19.0 #234 +/- ##
==========================================
+ Coverage 73.05% 73.12% +0.07%
==========================================
Files 1069 1076 +7
Lines 62080 62282 +202
==========================================
+ Hits 45351 45543 +192
- Misses 16729 16739 +10
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Motivation
sync_for_partners()entrypoint allowed arbitrary internal users to trigger outbound DCI lookups and populate sensitive disability/health indicators into the shared cachespp.data.valuewithout authorization.dr.dci.has_disability, severity flags) are sensitive and were readable bybase.group_uservia existing ACLs, creating a confidentiality risk.user_id, making scheduled execution ambiguous and potentially privileged operations less explicit.Description
_check_dci_sync_access()tospp.dci.cel.fetcherwhich raisesAccessErrorunless the caller has thespp_cel_domain.group_cel_domain_managergroup, and invoked it at the start ofsync_for_partners()to block low-privileged RPC/server calls.action_sync_dci_valuesto CEL Domain Managers by adding agroup_idsentry and set the scheduled cronuser_idtobase.user_rootso scheduled syncs remain explicit and privileged.base.group_userread permission formodel_spp_data_valueinspp_cel_domain/security/ir.model.access.csv(set read to0) so cached DCI values are no longer globally visible to basic internal users.base.group_user) receivesAccessErrorwhen callingsync_for_partners()directly (test_sync_for_partners_requires_cel_manager).Testing
python3 -m py_compileon the modified files (spp_dci_indicators/models/dci_cel_fetcher.pyand tests) and compilation succeeded.spp_dci_indicators/data/dci_sync.xml) withxml.etree.ElementTree.parseand performed a static ACL check onspp_cel_domain/security/ir.model.access.csv, both of which succeeded.git diff --checkand static checks with no reported issues.TransactionCasetest suite butimport odoofailed in this environment so full integration/unit test execution could not be performed here; a new unit test was added and should run in CI where Odoo is available.Codex Task