[Python] Odo 18 Record Rules help needed

I have created an Odoo 18 addon module enabling self-signup. Self-signup users are unable see to other self-signup users' documents (Achieved using record rules). The user adds a contact from the contact modules' kanban page.

To achieve this (and much more), I added a commercial_partner_id to the user which is correctly populating at self-registration. Functionally, everything works. When I disable my record rule,visibility and self-signup record creation is 100%. However, when my self-signup user tries to add another user in his/her own company, creation is prevented by my record rule and I receive this, initially comical, but now just frustrating message:


**Access Error**
Uh-oh! Looks like you have stumbled upon some top-secret records.

Sorry, Test Smith (id=9) doesn't have 'create' access to:
- Contact, Test2 Jones (res.partner: 43)

Blame the following rules:
- Restrict to own Contacts by Commercial Partner

If you really, really need access, perhaps you can win over your friendly administrator with a batch of freshly baked cookies.


I have tried many different configurations but here are my two record rules as they stand at the moment. All other rules temporarily removed:

<!-- Manager - view, create, edit own contacts -->
<record id="nc_res_partner_commercial_partner_own_rule" model="ir.rule">
<field name="name">Restrict to own Contacts by Commercial Partner</field>
<field name="model_id" ref="base.model_res_partner"/>
<field name="domain_force">[
'|', ('commercial_partner_id', '=', user.commercial_partner_id.id),
('commercial_partner_id', '=', False)
]</field>
<field name="groups" eval="[(4, ref('module_name.group_self-signup_manager'))]"/>
<field name="perm_read" eval="1"/>
<field name="perm_write" eval="1"/>
<field name="perm_create" eval="1"/>
<field name="perm_unlink" eval="0"/>
</record>

<record id="nc_res_partner_commercial_partner_other_rule" model="ir.rule">
<field name="name">Restrict to Main Company Contacts by Commercial Partner</field>
<field name="model_id" ref="base.model_res_partner"/>
<field name="domain_force">[('commercial_partner_id', '=', 1)]</field>
<field name="groups" eval="[(4, ref('module_name.group_self-signup_manager'))]"/>
<field name="perm_read" eval="1"/>
<field name="perm_write" eval="0"/>
<field name="perm_create" eval="0"/>
<field name="perm_unlink" eval="0"/>
</record>


Here's the bare minimum, showing how I override the res.partner create. Everything else is stripped out:

@api.model_create_multi
def create(self, vals_list):
if isinstance(vals_list, dict): # Ensure we handle single record cases
vals_list = [vals_list]

user = self.env.user # Get the current user

partners_to_create = []

for vals in vals_list:
email = vals.get('email', '').strip()
name = vals.get('name', '').strip()
website = vals.get('website', '').strip()
mobile = vals.get('mobile', '').strip()
commercial_partner_id = user.commercial_partner_id.id
parent_id = user.commercial_partner_id.id

partner = []
partner['email'] = email
partner['name'] = name
partner['website'] = website
partner['mobile'] = mobile
partner['commercial_partner_id'] = commercial_partner_id
partner['parent_id'] = parent_id

partners_to_create.append(partner)

partners = super(ResPartner, self).create(partners_to_create)
return partners


Disable the rule and everything works. Enable it, and error. Please tell me what I'm doing wrong Thanks

Continue reading...