[Erp5-dev] acquire local roles removed on Sale Invoice Transaction, accepting it but not everything works

[Łukasz Nowak]

Hello,

OK - acquire_local_roles in disabled on Sale Invoice Transaction. For
new I'm using revision which is done before this feature, so my users
won't be able to operate on Sale Invoice Transactions.

Is it enough to create _same_ Roles as in Accounting Transaction Module
portal type, update security settings and reindex site to have same
results as in _before_ acquire_local_roles was disabled?

In my case it do not work. I've made _exactly_ same Roles as on
Accounting Transaction Module (all was working) and this happens:

* user has access to Sale Invoice Transaction objects create _before_
acquire_local_roles
* user has access to Sale Invoice Transaction objects created _after_
acquire_local_roles, by Manager (Base_viewSecurity shows all roles for
certain users correctly)
* users aren't able to create new Sale Invoice Transaction (even
those which has roles: Author, Auditor, Assignor, Assignee, Associate)

This is what I do have in last case:
Error Type: Unauthorized
Error Value: Your user account does not have the required permission.
Access to 'getSimulationState' of (Invoice
at /erp5/accounting_module/475) denied. Your user account, shufla,
exists at /erp5/acl_users. Access requires
Access_contents_information_Permission, granted to the following roles:
['Assignee', 'Assignor', 'Associate', 'Auditor', 'Author', 'Manager'].
Your roles in this context are ['Authenticated', 'Member', 'Owner'].

Some questions:
- is such case tested anywhere in unit tests (I wasn't able to find it)
- if not, shall I prepare such unit test (I'm unit testing it right
now, but test is Ventis specific and no Nexedish in its style)

I am pretty sure, that it is my failure...

Regards,
Luke

[Łukasz Nowak]

Hello,

On 2007-09-17, 13:05:08

Post by Łukasz Nowak
Hello,

(...)

I've made some more investigation. Those problems are associated with
my workflow, which is trying to invoke getSimulationState on freshly
created Sale Invoice Transaction.

I've checked twice - no workflows revokes View or Access Content
Information permission from Sale Invoice Transaction portal type, but
I'm still not able to invoke getSimulationState on freshly creating
invoice.

So what might stopping user from invoking getSimulationState on freshly
creating invoice? (Or any other script/method which needs permission
View or Access Content Information)?

Any clues welcome :)

Regards,
Luke

[Jérome Perrin]

Post by Łukasz Nowak
Hello,
On 2007-09-17, 13:05:08

Post by Łukasz Nowak
Hello,

(...)
I've made some more investigation. Those problems are associated with
my workflow, which is trying to invoke getSimulationState on freshly
created Sale Invoice Transaction.
I've checked twice - no workflows revokes View or Access Content
Information permission from Sale Invoice Transaction portal type, but
I'm still not able to invoke getSimulationState on freshly creating
invoice.
So what might stopping user from invoking getSimulationState on freshly
creating invoice? (Or any other script/method which needs permission
View or Access Content Information)?

ERP5Type.ERP5Type.constructInstance calls _finishConstruction, which
calls notifyWorkflowCreated before this line:
if len(self._roles):
self.updateLocalRolesOnSecurityGroups(ob)

notifyWorkflowCreated will pass all possible workflow transitions. If
this is where your problem happen, can you try to call
"updateLocalRolesOnSecurityGroups" before _finishConstruction ?

( I'm not sure updateLocalRolesOnSecurityGroups works if
_setPortalTypeName hasn't been called before. )

J?rome

[Łukasz Nowak]

Hello,

On 2007-09-17, 18:07:23
J?rome Perrin <jerome at nexedi.com> wrote:

(...)

Post by Jérome Perrin
ERP5Type.ERP5Type.constructInstance calls _finishConstruction,

which

Post by Jérome Perrin
self.updateLocalRolesOnSecurityGroups(ob)
notifyWorkflowCreated will pass all possible workflow transitions. If
this is where your problem happen, can you try to call
"updateLocalRolesOnSecurityGroups" before _finishConstruction ?
( I'm not sure updateLocalRolesOnSecurityGroups works if
_setPortalTypeName hasn't been called before. )

Huh... Great tip! It is working right now, with attached patch. I'll
monkey-patch it in our system and we'll see if unit tests pass.

Regards,
Luke
--
?ukasz Nowak R&D Ventis http://www.ventis.com.pl/
tel: [phone] fax: [phone]
``Use the Source, Luke...''
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ERP5Type.py-patch-shufla-resolved
Type: application/octet-stream
Size: 978 bytes
Desc: not available
URL: <http://mail.tiolive.com/pipermail/erp5-dev/attachments/20070918/db8c6475/attachment.obj>

[Jérome Perrin]

Post by Łukasz Nowak
Error Type: Unauthorized
Error Value: Your user account does not have the required permission.
Access to 'getSimulationState' of (Invoice
at /erp5/accounting_module/475) denied. Your user account, shufla,
exists at /erp5/acl_users. Access requires
['Assignee', 'Assignor', 'Associate', 'Auditor', 'Author', 'Manager'].
Your roles in this context are ['Authenticated', 'Member', 'Owner'].

BTW, Do you have any workflow that remove 'Access contents information'
to Owner role in it's initial state ? This would be a misconfiguration.

J?rome

[Łukasz Nowak]

Hello,

On 2007-09-18, 14:34:59

Post by Jérome Perrin
BTW, Do you have any workflow that remove 'Access contents
information' to Owner role in it's initial state ? This would be a
misconfiguration.

AFAIK none - but I'll recheck it again.

Regards,
Luke

[Łukasz Nowak]

Hello,

On 2007-09-18, 14:44:15

Post by Łukasz Nowak
On 2007-09-18, 14:34:59

Post by Jérome Perrin
BTW, Do you have any workflow that remove 'Access contents
information' to Owner role in it's initial state ? This would be a
misconfiguration.

AFAIK none - but I'll recheck it again.

Checked twice - none of initial states in any of used workflows removes
'Access contents information' from Owner role.

Thanks for tip.

Regards,
Luke