DevelopersPre-alpha
Security & access
security.xml, sys.access.csv and how groups gate menus and records.
Groups in security.xml
Define a module category and groups that imply base.group_user (and a manager that implies the user group):
<?xml version="1.0" encoding="utf-8"?><sumeru> <data> <record id="module_category_my_module" model="sys.module.category"> <field name="name">My Module</field> <field name="sequence">100</field> </record> <record id="group_my_module_user" model="core.group"> <field name="name">User</field> <field name="category_id" ref="module_category_my_module"/> <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/> </record> <record id="group_my_module_manager" model="core.group"> <field name="name">Manager</field> <field name="category_id" ref="module_category_my_module"/> <field name="implied_ids" eval="[(4, ref('group_my_module_user'))]"/> </record> </data></sumeru>sys.access.csv
ACL rows grant CRUD per group. Model column uses the dotted model name; group column uses the XML id from security.xml.
id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlinkaccess_my_module_user,my_module.user,my.module,group_my_module_user,1,0,0,0access_my_module_manager,my_module.manager,my.module,group_my_module_manager,1,1,1,1| Column | Meaning |
|---|---|
perm_read | Search / read |
perm_write | Update |
perm_create | Create |
perm_unlink | Delete |
Load order
List security/security.xml before security/sys.access.csv in the manifest so groups exist when ACL rows resolve.
Compile and run
go run . -- -c sumeru.conf -u my_module --stop-after-initmake runWhat not to do
- Do not leave manager-level write/unlink on every group "for convenience".
- Do not point
group_id:idat an id from another module without adependsentry. - Do not confuse multi-company record rules with multi-tenant SaaS isolation. See the Security guides.
Next step
Seed records with Data XML, or read Security overview.