🎉 access_superuser

access_superuser/README.rst

@@ -0,0 +1,12 @@
+Access Superuser
+================
+
+In Superuser mode a User can control - who is eligible to become a Superuser.
+Candidate User should have Administration: Settings
+
+Typical usage of the module.
+----------------------------
+
+On Preference tab of user settings there is new field - Is Sudoer.
+
+Tested on `Odoo 14.0 <https://github.com/odoo/odoo/commit/c16d4b5e7b9181c2c792f595a117de10510d45be>`_

access_superuser/__init__.py

@@ -0,0 +1,2 @@
+from . import models
+from . import controllers

access_superuser/__manifest__.py

@@ -0,0 +1,17 @@
+{
+    "name": "Controllable Becoming a Superuser",
+    "summary": "Not any Admin can become a Superuser - there is new setting now allowing that",
+    "version": "14.0.0.0.1",
+    "author": "IT-Projects LLC, Ildar Nasyrov",
+    "category": "Extra Tools",
+    "images": ["images/banner.jpg"],
+    "support": "[email protected]",
+    "website": "https://twitter.com/OdooFree",
+    "license": "Other OSI approved licence",  # MIT
+    "currency": "EUR",
+    "depends": [],
+    "data": [
+        "views/res_users_views.xml",
+    ],
+    "installable": True,
+}

access_superuser/controllers/__init__.py

@@ -0,0 +1 @@
+from . import main

access_superuser/controllers/main.py

@@ -0,0 +1,13 @@
+from odoo import http
+from odoo.addons.web.controllers.main import Home
+from odoo.http import request
+
+
+class Home(Home):
+    @http.route()
+    def switch_to_admin(self):
+        uid = request.env.user.id
+        if request.env.user.is_sudoer:
+            return super(Home, self).switch_to_admin()
+        else:
+            return http.local_redirect(self._login_redirect(uid), keep_hash=True)

access_superuser/models/__init__.py

@@ -0,0 +1 @@
+from . import res_users

access_superuser/models/res_users.py

@@ -0,0 +1,59 @@
+from odoo import fields, models
+from odoo.exceptions import UserError
+from odoo.tools.translate import _
+
+
+class Users(models.Model):
+    _inherit = "res.users"
+
+    is_sudoer = fields.Boolean(
+        default=True,
+        help="""
+Is a User eligible to become a Superuser. If True and User is Admin (Administrator: Settings) - then ok""",
+    )
+
+    def write(self, vals):
+        """
+        if writing True in is_sudoer
+        check if system user
+        then let it pass or raise user error
+        """
+
+        if "is_sudoer" in vals and vals["is_sudoer"]:
+            if self.env.is_superuser() and self._is_system():
+                pass
+            else:
+                raise UserError(
+                    _(
+                        """
+                        Insufficient rights for making someone a Sudoer
+                        (You yourself should be in Superuser mode)
+                        or this User is not a System User
+                        (Administration: Settings)!"""
+                    )
+                )
+
+        if "is_sudoer" in vals and not vals["is_sudoer"]:
+            if self.env.is_superuser():
+                raise UserError(
+                    _(
+                        """
+                        To clear 'Is Sudoer' setting -
+                        please exit from Superuser mode,
+                        this way the System can
+                        check that you are not trying to do it
+                        on your own, which is prohibited
+                        because someone should be a sudoer"""
+                    )
+                )
+            elif self == self.env.user:
+                raise UserError(
+                    _(
+                        """
+                        You cannot uncheck 'Is Sudoer' setting on yourself -
+                        this prevents the situation when no one is
+                        eligible becoming Superuser"""
+                    )
+                )
+
+        return super(Users, self).write(vals)

access_superuser/views/res_users_views.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+  <record id="view_users_form" model="ir.ui.view">
+    <field name="name">res.users.form.inheirt.sudoer.preference</field>
+    <field name="model">res.users</field>
+    <field name="inherit_id" ref="base.view_users_form"/>
+    <field name="arch" type="xml">
+      <xpath expr="//group[@name='messaging']" position="after">
+        <group name="sudoer">
+          <field name="is_sudoer" groups="base.group_system"/>
+        </group>
+      </xpath>
+    </field>
+  </record>
+</odoo>