61a0cb244f
Record rule grants admins an unrestricted domain on the audit log;
ACL forbids write/create/unlink for every group (audit is append-only;
sudo() inside auth hooks is the only write path). Defence-in-depth
layering: ACL is the actual gate, the rule documents and locks down
admin access path.
Tests (5, all green) cover:
test_admin_can_read_through_acl_and_rule — positive path through both.
test_acl_blocks_read_for_regular_user — base.group_user denied by ACL.
test_acl_blocks_read_for_portal_user — base.group_portal share user
denied (sensitive data leakage
surface closed at ACL layer).
test_acl_blocks_write_for_admin — append-only at the write boundary.
test_acl_blocks_unlink_for_admin — append-only at the unlink boundary.
Drop the redundant `from . import tests` from the root __init__.py —
Odoo's test loader imports `odoo.addons.<mod>.tests` directly; the
extra import was dead weight (and inconsistent with the repo pattern).
CLAUDE.md gotchas added during this task:
#6 res.users.groups_id -> group_ids rename (test setUp pitfall).
#6 ir.rule `groups` is additive, not restrictive — group-scoped
rules only apply to users in that group, they do not restrict
non-members. Default to letting the ACL gate; use rules for
row-level filters ACLs cannot express.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
31 lines
1011 B
Python
31 lines
1011 B
Python
# -*- coding: utf-8 -*-
|
|
# Copyright 2026 Nexa Systems Inc.
|
|
# License OPL-1 (Odoo Proprietary License v1.0)
|
|
{
|
|
'name': 'Fusion Login Audit',
|
|
'version': '19.0.1.0.0',
|
|
'category': 'Tools',
|
|
'summary': 'Durable login audit log with geo-enrichment, retention, and failure alerts.',
|
|
'description': """
|
|
Fusion Login Audit
|
|
==================
|
|
|
|
Captures every password authentication event (success + failure) in a
|
|
dedicated, append-only audit table. Surfaces history on the user form
|
|
as a smart button + tab (admins only). Async-enriches IPs with country,
|
|
city, and reverse DNS. Emails Settings admins on consecutive-failure
|
|
bursts. Daily retention cron honours a configurable horizon.
|
|
""",
|
|
'author': 'Nexa Systems Inc.',
|
|
'website': 'https://nexasystems.ca',
|
|
'license': 'OPL-1',
|
|
'depends': ['base', 'mail'],
|
|
'data': [
|
|
'security/ir.model.access.csv',
|
|
'security/security.xml',
|
|
],
|
|
'installable': True,
|
|
'application': False,
|
|
'auto_install': False,
|
|
}
|