60 lines
2.1 KiB
Python
60 lines
2.1 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo import models, api, _
|
|
from odoo.exceptions import ValidationError
|
|
|
|
|
|
class ResUsers(models.Model):
|
|
_name = "res.users"
|
|
_inherit = ["l10n_au.audit.logging.mixin", "res.users"]
|
|
# Force the mixin to be at the bottom to pass context to prevent
|
|
# duplications due to group_ids
|
|
|
|
@api.model
|
|
def _get_display_name_fields(self):
|
|
return ["name"]
|
|
|
|
@api.model
|
|
def _get_audit_logging_fields(self):
|
|
return ["password", "company_ids"]
|
|
|
|
def _records_to_log(self):
|
|
return self.filtered(lambda r: "AU" in r.mapped("company_ids.country_code"))
|
|
|
|
def _is_privileged_australian_user(self):
|
|
"""Check if the user is a privileged user for Australian Payroll."""
|
|
self.ensure_one()
|
|
sudo_self = self.sudo()
|
|
if "AU" not in sudo_self.company_ids.mapped("country_code"):
|
|
return False
|
|
return self in sudo_self.env["res.groups"]._l10n_au_get_privileged_groups().user_ids
|
|
|
|
def _mfa_type(self):
|
|
""" Enforce TOTP MFA for privileged Australian users. """
|
|
r = super()._mfa_type()
|
|
if r is not None:
|
|
return r
|
|
if self._is_privileged_australian_user():
|
|
return 'totp_mail'
|
|
|
|
def _restrict_social_oauth(self):
|
|
""" Prevent the use of social media accounts for OAuth for Australian users. """
|
|
facebook_auth = self.env.ref("auth_oauth.provider_facebook", raise_if_not_found=False)
|
|
for user in self:
|
|
if user._is_internal() and facebook_auth:
|
|
if user["oauth_provider_id"] == facebook_auth:
|
|
raise ValidationError(
|
|
_("The Facebook OAuth provider is not supported for internal users with the Australian Payroll Integration!")
|
|
)
|
|
|
|
def write(self, vals):
|
|
if "oauth_provider_id" in vals:
|
|
self._restrict_social_oauth()
|
|
return super().write(vals)
|
|
|
|
def create(self, vals):
|
|
users = super().create(vals)
|
|
if "oauth_provider_id" in self._fields:
|
|
users._restrict_social_oauth()
|
|
return users
|