RBAC Technical Architecture & Data Model

This technical reference outlines the architecture of smarterp_rbac for developers and security architects.

Entity Relationship Model#

 +----------------------------------+          +----------------------------------+
 |          res.users.role          |          |        smarterp.rbac.pack        |
 +----------------------------------+          +----------------------------------+
 | id : integer                     | 1      * | id : integer                     |
 | name : char                      +--------->| name : char                      |
 | code : char                      |          | group_ids : res.groups           |
 | pack_ids : smarterp.rbac.pack    |          +----------------------------------+
 +----------------------------------+
                  | 1
                  |
                  v *
 +----------------------------------+          +----------------------------------+
 |       smarterp.rbac.request      |          |     smarterp.rbac.sod.rule       |
 +----------------------------------+          +----------------------------------+
 | id : integer                     |          | id : integer                     |
 | user_id : res.users              |          | role_a_id : res.users.role       |
 | role_id : res.users.role         |          | role_b_id : res.users.role       |
 | state : selection                |          | severity : selection             |
 | justification : text             |          | rationale : text                 |
 +----------------------------------+          +----------------------------------+

Key Python Methods#

def action_approve(self):
    self.ensure_one()
    # Enforce SoD validation prior to granting
    conflicts = self._check_sod_conflicts(self.user_id, self.role_id)
    if any(c.severity == 'blocking' for c in conflicts):
        raise ValidationError(_("Cannot approve request: blocking SoD conflict detected."))
    self.role_id.user_ids = [(4, self.user_id.id)]
    self._create_audit_entry('grant')
    self.state = 'approved'