Skip to content

pyvelm v0.10.0

Release date: 2026-05-26

Policies, UI access gating, public landing page, configurable home URL, sudo mode, and public attachments — plus install/ACL fixes for real multi-user demos.

Highlights

Policies (Laravel-style, on top of ACL)

Record-aware authorization via env.can() / env.check_can() and register_policy(). Built-in policies gate management screens (Settings, Security, workflow admin lists, Apps catalog) so shell grants like Everyone/read on res.users no longer expose admin menus.

# menu.py
m.item("settings.users", "Users", parent="settings",
       view="user.list", policy="view_any")

See security.md.

Access UX

  • Read opens the page — list/form/kanban render when the user has read; New, Edit, Delete, header actions, and list-row actions hide when the matching perm (or policy) fails.
  • Access denied — styled HTML page for browser 403s (not JSON); minimal top-nav shell on feedback capture and account routes.
  • Sidebar menus — access_model / access_perm / access_policy on ir.ui.menu; empty groups pruned.

Site entry

  • / — public landing page with Get started → login (PYVELM_LANDING, default on).
  • PYVELM_HOME_URL — post-login home (default /web/admin; set to / or /web/views/<module>/<dashboard> for a custom root).

Sudo & attachments

  • env.sudo() / recordset.sudo() — bypass ACL and record rules while keeping the real uid (Odoo-style).
  • ir.attachment.public — logos, favicons, and avatars served without granting every user attachment read.

ACL helpers

  • pyvelm.security.grant_model_access() — seed Admin / User / Public rows consistently in module hooks.
  • User group backfill runs once (migration 0_23→0_24), not on every Apps Sync / dev reload — Sales-only accounts stay Sales-only after you edit groups in Settings.

Upgrade

pip install -U pyvelm
  1. pyvelm db migrate — applies base migrations through 0_24→0_25 (access_policy on menus, attachment public, etc.).
  2. Apps → Sync (or restart examples/serve.py) so menu and view data reload.
  3. Optional .env:
PYVELM_HOME_URL=/web/views/feedback_signals/home
PYVELM_LANDING=1
  1. Hard-refresh the browser.

If operators still have avatar_url stored as the literal string False from an older profile save, clear or re-upload the avatar once on My profile.

Also in this release

  • Workflow User read limited to workflow.approval (inbox); instance/task admin lists admin-only; readonly workflow bar on records via targeted sudo.
  • maybe_auto_start_workflow — skips when workflow_definition table is missing (fixes poisoned transactions on first install).
  • Many2one labels — sudo fallback for display_name when the user lacks read on the comodel.
  • Profile save — empty avatar no longer writes False to avatar_url.
  • Tests: test_security, test_policies, test_home, test_policy_ui_gating, test_apps_catalog_gating, test_view_access.