#!/usr/bin/env python3
"""What is true about the place this code will actually live.
WHY THIS EXISTS
---------------
ARCHITECTURE records the context layer as absent by design, and names the reason
honestly: odoo.ondelete-is-a-decision cannot be decided from a snippet, because
whether a dangling reference matters depends on whether anything ever reads the
field back -- context a snippet does not contain.
That reasoning is correct about snippets and wrong about files. When the input is
a real path in a real tree, the context is sitting on disk: the module manifest
says which Odoo version this has to run on, the file says which model it extends,
ir.model.access.csv says whether the model can be deleted at all. None of it
needs a model to guess.
So this module reads the surroundings, and the context layer reports UNKNOWN --
never PASS -- whenever it was handed a snippet with no surroundings to read. An
absent context is a stated gap, not a clean bill of health.
Stdlib only.
"""
import ast
import csv
import io
import json
import os
import re
CONTEXT_VERSION = "1.0.0"
MANIFEST_NAMES = ("__manifest__.py", "__openerp__.py")
MAX_WALK_UP = 6
_VERSION_RE = re.compile(r"[\"']version[\"']\s*:\s*[\"']([0-9.]+)[\"']")
# An and the two fields that decide whether it filters
# anything. Attribute order is not fixed -- one OpenSPP file writes ref= before
# name= on every row, which is 10 of that tree's 239 rules -- so model_id is
# matched without assuming which attribute comes first.
_IR_RULE_RE = re.compile(
r"]*\bmodel=[\"']ir\.rule[\"'][^>]*>(.*?)", re.S)
_RULE_MODEL_RE = re.compile(
r"]*\bname=[\"']model_id[\"'])[^>]*\bref=[\"']([\w.]+)[\"']")
_RULE_DOMAIN_RE = re.compile(
r"]*\bname=[\"']domain_force[\"'][^>]*>(.*?)", re.S)
# A domain that matches every row filters nothing, so sudo cannot drop it. This
# is the whole of `[(1, '=', 1)]` in any spacing; anything else is treated as a
# real filter, because deciding that a domain is vacuous in general means
# evaluating it.
_VACUOUS_DOMAIN = re.compile(r"^\[\s*\(\s*1\s*,\s*[\"']=[\"']\s*,\s*1\s*\)\s*\]$")
# The left operand of every leaf in a domain: the fields the rule filters ON.
# A domain is a flat list of triples once the operators are ignored, and the
# first element of each is a field path. Read for one purpose only -- deciding
# whether a call under sudo names the field the rule it bypasses is about --
# and a field this fails to read simply is not offered as an exemption.
_RULE_FIELD_RE = re.compile(r"[\(\[]\s*[\"']([a-z_][a-z0-9_.]*)[\"']\s*,")
_NAME_RE = re.compile(r"[\"']name[\"']\s*:\s*[\"']([^\"']+)[\"']")
_MODEL_RE = re.compile(r"^\s*_(?:name|inherit)\s*=\s*[\"']([a-z0-9_.]+)[\"']", re.M)
_ODOO_IMPORT_RE = re.compile(r"^\s*from\s+odoo[\w.]*\s+import\s+(.+)$", re.M)
# What this corpus is able to review, and nothing else. One table, read by
# subject.route as well, so a file cannot be refused by the command and
# contextualised here anyway.
#
# .py is where every rule but one lives; .xml carries the noupdate rule, whose
# violation is a in a data file. Anything else is refused by name
# rather than reviewed: the Odoo rules run over a .ts file find nothing, and
# nothing reads as a clean bill of health.
REVIEWABLE = (".py", ".xml")
def stack_for(path):
"""The rule stack a file belongs to. There is one, and this says whether
the file is in it.
Returns "odoo" for a file the corpus can review and None for one it cannot.
Both an Odoo module and a plain Python script return "odoo": the corpus
holds the ORM rules and the plain-Python rules together, so there is no
longer a second stack to send a script to, and a script inside an Odoo
repository -- scripts/, tools/, a migration helper -- is reviewed against
the language rules, with the ORM rules finding nothing in it.
"""
if os.path.splitext(path)[1].lower() in REVIEWABLE:
return "odoo"
return None
def _walk_up(start, names):
"""Nearest ancestor directory containing any of `names`, with the hit."""
directory = os.path.dirname(os.path.abspath(start))
for _ in range(MAX_WALK_UP):
for name in names:
candidate = os.path.join(directory, name)
if os.path.isfile(candidate):
return candidate
parent = os.path.dirname(directory)
if parent == directory:
break
directory = parent
return None
_READ_LIMIT = 200000
def _read(path, limit=_READ_LIMIT):
try:
with io.open(path, encoding="utf-8", errors="ignore") as fh:
return fh.read(limit)
except OSError:
return ""
def _odoo_series(version):
"""'18.0.1.0.3' -> '18.0'. Odoo module versions carry the series in front."""
parts = version.split(".")
return ".".join(parts[:2]) if len(parts) >= 2 else version
def from_file(path, stack=None):
"""Everything knowable about a file's environment without running anything.
Every key is either a real finding or None. None means 'not determinable
here', and the context layer reports it as UNKNOWN rather than assuming a
default -- an assumed Odoo version is worse than a missing one, because it
silently answers a version question nobody verified.
`stack` overrides the extension guess, and callers that have one should pass
it: the extension cannot tell an Odoo module from a plain Python script, and
a context labelled odoo goes looking for a __manifest__.py that a script was
never going to have.
"""
ctx = {
"path": os.path.abspath(path),
"stack": stack or stack_for(path),
"source": "file",
"odoo_series": None,
"module": None,
"manifest": None,
"models": [],
"odoo_imports": [],
"is_test": False,
# How much of the file the answer was about. Filled in by subject.plan,
# which is the only thing that knows; None means nobody chose an
# excerpt, which is the case for a bare question.
"reviewed": None,
}
body = _read(path)
base = os.path.basename(path).lower()
ctx["is_test"] = base.startswith("test_") or ".test." in base or ".spec." in base \
or os.sep + "tests" + os.sep in ctx["path"].lower()
if ctx["stack"] in ("odoo", "python"):
# Both gather the same way. A .py file that turns out to be plain Python
# has no manifest above it -- that is how it was routed to python in the
# first place -- so the walk costs nothing and the alternative is two
# branches that have to stay in step.
manifest = _walk_up(path, MANIFEST_NAMES)
if manifest:
text = _read(manifest)
ctx["manifest"] = manifest
ctx["module"] = os.path.basename(os.path.dirname(manifest))
found = _VERSION_RE.search(text)
if found:
ctx["odoo_series"] = _odoo_series(found.group(1))
elif _NAME_RE.search(text):
ctx["odoo_series"] = None # a manifest with no version pin
ctx["models"] = sorted(set(_MODEL_RE.findall(body)))
imports = []
for line in _ODOO_IMPORT_RE.findall(body):
imports.extend(part.strip() for part in line.split(",") if part.strip())
ctx["odoo_imports"] = sorted(set(imports))
return ctx
def empty(stack):
"""The context for a bare question: nothing known, and said so.
Returned for `nexa ask`, where there is no file and therefore no
surroundings. The layer above turns this into UNKNOWN.
"""
return {
"path": None,
"stack": stack,
"source": "none",
"odoo_series": None,
"module": None,
"manifest": None,
"models": [],
"odoo_imports": [],
"is_test": False,
# How much of the file the answer was about. Filled in by subject.plan,
# which is the only thing that knows; None means nobody chose an
# excerpt, which is the case for a bare question.
"reviewed": None,
}
# ------------------------------------------------------------ tree triggers
#
# Some rules are conditional on a fact no single file contains.
#
# ondelete-is-a-decision the harm is a dangling read after the PARENT is
# deleted. If nothing ever deletes the parent -- if
# it is master data -- there is no dangling read to
# have.
# check-company-on-relations the harm is a record in company A referencing
# company B's. A codebase running one company cannot
# exhibit it.
#
# Both are answerable from the tree, and answering them is what turns a rule that
# describes a CONSTRUCT into one that describes a DEFECT -- for the subset where
# the answer is available, and only there. The three-valued result is the whole
# point: PRESENT promotes the finding, ABSENT drops it, and UNKNOWN leaves the
# rule exactly where it was rather than inventing a default. This module already
# reports UNKNOWN over an assumed Odoo version for the same reason.
PRESENT = "present"
ABSENT = "absent"
UNKNOWN = "unknown"
# ir.model.access.csv is where Odoo records whether a model can be deleted AT
# ALL. A model with perm_unlink 0 in every row cannot be deleted through the UI
# by anybody, which is the half of the question reading Python can never answer.
_PERM_UNLINK_TRUE = ("1", "true", "True", "TRUE")
# For the module-sized walk only. fieldtest owns the list for whole-tree walks,
# because it owns the walk.
_SKIP_DIRS = frozenset([".git", ".hg", "node_modules", "static", "__pycache__",
".tox", ".venv", "venv", "dist", "build", "migrations"])
_TRIGGER_EXTENSIONS = (".py", ".csv", ".xml")
_MODULE_FILE_CAP = 400
# The modules a checked module depends on are read for their ORM declarations
# alone (module_facts). Test directories are left out of that read, as
# fieldtest's trigger walk leaves them out: a model a test declares is not
# installed with the module. Past the cap the read costs seconds, about two
# for a thousand files of Odoo core on the machine it was measured on.
_TEST_DIRS = frozenset(["tests", "test", "__tests__", "spec"])
_CLOSURE_FILE_CAP = 1000
_MODULE_NAME_RE = re.compile(r"^[A-Za-z0-9_]+$")
def no_tree():
"""The facts for a file with no tree around it: nothing walked, nothing
claimed. Every trigger reads UNKNOWN off this, which is what `nexa check`
on a single path gets and is the honest answer there."""
return {"walked": False, "complete": False, "files": 0,
"models_declared": set(), "models_deleted": set(),
"multi_company": None, "odoo_series": None}
def tree_facts(paths, complete=True):
"""Walk a tree once and record what the triggers need to know.
`paths` is an iterable of file paths -- the caller owns the walk, because the
module that already knows how to skip a node_modules is the one that should
keep doing it. Python files, ir.model.access.csv and XML data files are each
read for what only they can say.
`complete` is whether those paths were the WHOLE codebase. It decides what
the facts may be used for, and the two uses have different bars:
promoting positive evidence stays positive however little was read. A
module that deletes spp.vocabulary deletes it.
suppressing "nothing deletes this" is only true of everything that was
read, so a partial walk must not say it. A model declared in
one module and deleted in another would otherwise vanish from
the report on the strength of not looking.
So `nexa check` walks one module and gets promotions only; `fieldtest` walks
the roots it was given and gets both.
The ORM facts keep what they were made from, `orm_inputs`, so module_facts
can add the modules a checked module depends on without reading its own
files a second time.
Returns a dict whose `walked` is True. That flag is the difference between
"this tree does not delete res.partner" and "nobody looked", and every
trigger below refuses to answer without it.
"""
import semantics # local: context is imported by modules semantics is not
declared, deleted = set(), set()
unlink_tokens = set()
ruled = {}
rule_sets = {}
multi_company = False
seen = 0
# Every series the manifests in this walk name. Kept as a set because
# disagreement is not an average: a tree holding a 16 module beside a 19
# module has no single answer, and a checker that needs the series must
# hear that it cannot have one rather than be handed whichever came first.
series_seen = set()
manifests = {}
declarations = []
for path in paths:
lower = path.lower()
body = _read(path)
if not body:
continue
seen += 1
if os.path.basename(lower) in MANIFEST_NAMES:
found = _VERSION_RE.search(body)
series_seen.add(_odoo_series(found.group(1)) if found else None)
manifests[os.path.dirname(os.path.abspath(path))] = _manifest_depends(body)
if lower.endswith(".py"):
declared |= semantics.models_declared(body)
deleted |= semantics.models_unlinked(body)
if not multi_company and semantics.declares_multi_company(body):
multi_company = True
# Read whole for this: _read stops at 200,000 characters, and
# account_move.py, account_tax.py and mail_thread.py are longer.
# A file cut short does not parse, and would declare nothing.
whole = _read(path, None) if len(body) >= _READ_LIMIT else body
declarations.append((path, semantics.orm_declarations(whole)))
elif lower.endswith(".csv"):
if os.path.basename(lower).startswith("ir.model.access"):
unlink_tokens |= _models_granted_unlink(body)
elif lower.endswith(".xml"):
# Multi-company record rules live in XML and nowhere else. The same
# markers work here: a domain reading company_ids is the rule that
# only exists when several companies do.
if not multi_company and any(m in body for m in
semantics.MULTI_COMPANY_MARKERS):
multi_company = True
if "ir.rule" in body:
for model, fields in _models_with_a_filtering_rule(body).items():
ruled.setdefault(model, set()).update(fields)
for model, rules in _rules_one_by_one(body).items():
rule_sets.setdefault(model, []).extend(rules)
# Access tokens are matched FORWARDS, from each declared model to the token
# it would have. Parsing `model_sale_order_line` back into a dotted name is
# ambiguous -- sale.order.line and sale.order_line spell it identically --
# and going this way there is nothing to guess.
for model in declared:
if "model_" + model.replace(".", "_") in unlink_tokens:
deleted.add(model)
# One series, agreed by every manifest that pinned one, or nothing.
pinned = {v for v in series_seen if v}
facts = {"walked": True, "complete": complete, "files": seen,
"models_declared": declared, "models_deleted": deleted,
"models_record_ruled": ruled,
"models_rule_fields": {m: tuple(sorted(f)) for m, f in ruled.items()},
"models_rule_sets": rule_sets,
"multi_company": multi_company,
"odoo_series": pinned.pop() if len(pinned) == 1 else None}
facts.update(_orm_facts(declarations, manifests))
facts["orm_inputs"] = (declarations, manifests)
return facts
def _with_declarations(facts, paths):
"""The facts with what more files declare added to their ORM facts, and
nothing else: the modules a checked module depends on (module_facts).
Python files only, read for their models' fields and methods and their
manifests' depends. What they declare can only add to what the depends
check finds declared, so the walk is no more complete than it was, and
every other fact stays that of the walk.
"""
import semantics # local, as in tree_facts
declarations, manifests = facts["orm_inputs"]
declarations, manifests = list(declarations), dict(manifests)
for path in paths:
lower = path.lower()
body = _read(path)
if not body or not lower.endswith(".py"):
continue
if os.path.basename(lower) in MANIFEST_NAMES:
manifests[os.path.dirname(os.path.abspath(path))] = _manifest_depends(body)
whole = _read(path, None) if len(body) >= _READ_LIMIT else body
declarations.append((path, semantics.orm_declarations(whole)))
wider = dict(facts)
wider.pop("with_dependencies", None)
wider.update(_orm_facts(declarations, manifests))
wider["orm_inputs"] = (declarations, manifests)
return wider
def _manifest_depends(body):
"""The modules a manifest depends on, or () when it cannot be read."""
try:
manifest = ast.literal_eval(body.strip())
except (ValueError, SyntaxError, MemoryError, RecursionError):
return ()
depends = manifest.get("depends") if isinstance(manifest, dict) else None
return tuple(d for d in depends or () if isinstance(d, str))
def _orm_facts(declarations, manifests):
"""What the walk declares about its models, each part tagged with its module.
The depends check asks three things no single file answers: whether a
compute's field is stored, which @api.depends Odoo merges into a method from
its other definitions, and what a declared computed field depends on in
turn. Each answer is only good where the module that gives it is installed,
so every declaration keeps the module it ships in, and a module is the
directory holding its manifest.
modules {module: the modules its manifest depends on}
module_dirs {directory: module}
orm_fields {model: {field: [(module, declaration)]}}
orm_methods {model: {method: [(module, @api.depends or None)]}}
orm_parents {model: [(module, a model it inherits)]}
orm_named the models some class in the walk names with _name
"""
module_dirs = {directory: os.path.basename(directory) for directory in manifests}
modules = {os.path.basename(directory): depends
for directory, depends in manifests.items()}
fields, methods, parents, named = {}, {}, {}, set()
for path, records in declarations:
module = _module_at(path, module_dirs)
for record in records:
model = record["model"]
if record["named"]:
named.add(model)
for field, declaration in record["fields"].items():
fields.setdefault(model, {}).setdefault(field, []).append(
(module, declaration))
for method, depends in record["methods"].items():
methods.setdefault(model, {}).setdefault(method, []).append(
(module, depends))
for parent in record["parents"]:
parents.setdefault(model, []).append((module, parent))
return {"modules": modules, "module_dirs": module_dirs, "orm_fields": fields,
"orm_methods": methods, "orm_parents": parents, "orm_named": named}
def _module_at(path, module_dirs):
"""The module a file ships in: the nearest directory above it holding a
manifest the walk read. None for a file outside every module."""
directory = os.path.dirname(os.path.abspath(path))
while True:
if directory in module_dirs:
return module_dirs[directory]
parent = os.path.dirname(directory)
if parent == directory:
return None
directory = parent
def for_file(facts, path):
"""The tree facts as one file sees them: the same facts, and its module.
The ORM facts are answered per module, and which module is asking is the
one thing about them that changes from file to file. A shallow copy, so
the walk's facts are shared and only the key is the file's own.
"""
if not facts or not facts.get("walked"):
return facts
return dict(facts, module=_module_at(path, facts.get("module_dirs") or {}))
def module_closure(facts, module):
"""Every module installed whenever `module` is: itself, what its manifest
depends on, transitively, and base, which every module depends on.
None when the module is unknown, which is not the same as having none.
"""
if not facts or not module:
return None
modules = facts.get("modules") or {}
seen = {module, "base"}
stack = [module]
while stack:
for depend in modules.get(stack.pop(), ()):
if depend not in seen:
seen.add(depend)
stack.append(depend)
return seen
def _models_with_a_filtering_rule(body):
"""Models this XML gives an ir.rule that actually filters something.
A rule whose domain_force is `[(1, '=', 1)]` is a grant, not a filter: it
exists to widen access for a group and matches every row. sudo() drops it
and nothing changes, so a model whose only rules are those is no different
from a model with none.
Measured on OpenSPP, that distinction is most of this trigger's value: of
the 30 `.sudo().search(` findings sitting on a model with any rule at all,
10 were on spp.vocabulary.code, whose single rule is exactly that.
The ref is turned into a dotted name forwards -- `model_spp_area` becomes
spp.area -- which is ambiguous for a model whose own name contains an
underscore. That is the same ambiguity _models_granted_unlink avoids by
matching forwards from declared models, and it is not avoidable here
because the rule names the model and nothing else does.
A rule this fails to read therefore reads as "no rule", and for a model the
tree declares that SUPPRESSES a finding -- the unsafe direction, and the one
thing in this trigger worth being careful about. Two things hold it down:
the parse is deliberately loose about attribute order, because one OpenSPP
file writes `ref=` before `name=` on all ten of its rules and a stricter
pattern silently lost them; and a model whose rules are all unreadable is a
model nobody can show is protected, which is a finding worth making anyway.
"""
found = {}
for block in _IR_RULE_RE.findall(body):
ref = _RULE_MODEL_RE.search(block)
if not ref:
continue
token = ref.group(1).rsplit(".", 1)[-1]
if not token.startswith("model_"):
continue
domain = _RULE_DOMAIN_RE.search(block)
text = " ".join(domain.group(1).split()) if domain else ""
if text and _VACUOUS_DOMAIN.match(text):
continue
model = token[len("model_"):].replace("_", ".")
fields = found.setdefault(model, set())
for path in _RULE_FIELD_RE.findall(text):
# Both the path and the relation it starts from. A rule reading
# `case_id.case_worker_id` is satisfied by a create that names
# `case_id`, because the case it points at is one the caller
# can already see and the rule follows the link to find out.
fields.add(path)
fields.add(path.split(".", 1)[0])
return found
def _rules_one_by_one(body):
"""{model: [(is_global, fields)]}, one entry per filtering rule.
_models_with_a_filtering_rule merges every rule's fields per model, which
answers "is this model ruled" and cannot answer "did this call re-apply the
rules". Odoo ANDs global rules -- the ones with no groups -- for everybody,
and applies group rules per audience. product.template carries both: a
global company rule, and a website rule for public and portal users only.
A sudo() search naming website_published re-applied the second and not the
first, and the merged set read that as re-scoped.
"""
found = {}
for block in _IR_RULE_RE.findall(body):
ref = _RULE_MODEL_RE.search(block)
if not ref:
continue
token = ref.group(1).rsplit(".", 1)[-1]
if not token.startswith("model_"):
continue
domain = _RULE_DOMAIN_RE.search(block)
text = " ".join(domain.group(1).split()) if domain else ""
if text and _VACUOUS_DOMAIN.match(text):
continue
fields = set()
for path in _RULE_FIELD_RE.findall(text):
fields.add(path)
fields.add(path.split(".", 1)[0])
is_global = not re.search(r"name\s*=\s*[\"']groups[\"']", block)
found.setdefault(token[len("model_"):].replace("_", "."), []).append(
(is_global, tuple(sorted(fields))))
return found
def model_rule_sets(facts, model):
"""This model's filtering rules one by one, as (is_global, fields).
Empty when the tree declares no readable rule for it, which leaves callers
on their fallback.
"""
if not facts or not facts.get("walked") or not model:
return ()
return tuple(facts.get("models_rule_sets", {}).get(model, ()))
def model_is_record_ruled(facts, model):
"""Would sudo() on this model actually drop a filter?
PRESENT if the tree declares an ir.rule for it that filters. ABSENT if a
whole tree was walked, the tree DECLARES the model, and no filtering rule
came with it. UNKNOWN otherwise.
The rule this backs says sudo "drops ir.rule filtering". Where there is no
filtering to drop, the finding describes something that cannot happen, and
on OpenSPP that was 83 of 106 findings.
The model must be declared here for ABSENT to mean anything, and getting
that wrong is measurable rather than theoretical. A walk of an addons tree
sees the addons' rules and not Odoo's own: product.template carries core's
company rule, which lives in the `product` module and not in the tree being
read. Answering ABSENT from that silence dropped three true positives in
spp_api_v2_products on the first run of this trigger -- a sudo lookup of
every company's products, which is exactly the leak the rule is about.
So silence about a model nobody declared is UNKNOWN, and the finding
stands. The tree can say "we declare this and give it no rule". It cannot
say anything about a model it never saw.
"""
if not facts or not facts.get("walked") or not model:
return UNKNOWN
if model in facts.get("models_record_ruled", ()):
return PRESENT
if not facts.get("complete"):
return UNKNOWN
return ABSENT if model in facts.get("models_declared", ()) else UNKNOWN
def model_rule_fields(facts, model):
"""The fields this model's own filtering rules are written about.
`[('case_worker_id', '=', user.id)]` yields `case_worker_id`, and
`[('case_id.case_worker_id', '=', user.id)]` yields both the path and
`case_id`, the relation it is reached through.
This exists so a call under sudo can be compared against the rule it
would actually bypass, instead of against the word `company_id`. A
per-user rule is as real as a multi-company one -- OpenSPP's case models
are governed entirely by `case_worker_id` and `case_id.case_worker_id`,
and not one of them has a company rule at all -- so a checker that knows
only the multi-company spelling cannot see when the advice was followed.
Empty for a model nobody declared a readable rule for, which offers no
exemption and leaves the finding standing.
"""
if not facts or not facts.get("walked") or not model:
return ()
return tuple(facts.get("models_rule_fields", {}).get(model, ()))
def _models_granted_unlink(body):
"""The `model_id:id` tokens an ir.model.access.csv grants perm_unlink on."""
rows = list(csv.reader(io.StringIO(body)))
if not rows:
return set()
header = [cell.strip() for cell in rows[0]]
try:
model_at = header.index("model_id:id")
unlink_at = header.index("perm_unlink")
except ValueError:
return set()
granted = set()
for row in rows[1:]:
if len(row) <= max(model_at, unlink_at):
continue
if row[unlink_at].strip() not in _PERM_UNLINK_TRUE:
continue
# Rows carry either `model_x_y` or `module.model_x_y`.
token = row[model_at].strip().split(".")[-1]
if token:
granted.add(token)
return granted
def module_facts(path, stack, addons=()):
"""Tree facts for the Odoo module a single file sits in, or nothing.
`nexa check` is handed one path, and the tree that would answer its triggers
is on disk around it. Walking the whole repository for one file would cost
more than the review; walking the MODULE is bounded, and a module is the unit
Odoo itself ships and installs.
The modules its manifest depends on, transitively, can be read as well,
beside it or in `addons`, for their ORM declarations alone
(_dependency_sources). Each is installed whenever this one is, and the
depends check needs them: Odoo merges a compute's @api.depends from their
definitions and triggers through their fields (ARCHITECTURE 3.84). They
are read only when the depends check asks (with_dependencies), which it
does for a read the module's own declarations leave uncovered: most files
never have one, and reading them cost seconds (ARCHITECTURE 3.86).
Marked incomplete, so nothing it did not read can drop a finding. What it
read can promote one, and a declaration it read can answer the depends
check. See tree_facts for why those need different bars.
"""
if stack != "odoo" or not path:
return no_tree()
manifest = _walk_up(path, MANIFEST_NAMES)
if not manifest:
return no_tree()
root = os.path.dirname(manifest)
found = []
for dirpath, dirnames, filenames in os.walk(root):
dirnames[:] = [d for d in dirnames if d not in _SKIP_DIRS]
for name in sorted(filenames):
if name.endswith(_TRIGGER_EXTENSIONS):
found.append(os.path.join(dirpath, name))
if len(found) > _MODULE_FILE_CAP:
# A module this large is not the bounded walk this was meant to be.
# Better to say nothing than to make `check` feel like a build.
return no_tree()
facts = for_file(tree_facts(found, complete=False), path)
def wider():
sources = _dependency_sources(manifest, addons)
return _with_declarations(facts, sources) if sources else None
facts["with_dependencies"] = _OnFirstUse(wider)
return facts
class _OnFirstUse(object):
"""A value made the first time it is asked for, and kept for every later ask.
for_file copies the facts shallowly, so every file of a module shares one,
and the modules it depends on are read at most once however many ask.
"""
def __init__(self, make):
self._make, self._made, self._value = make, False, None
def __call__(self):
if not self._made:
self._value, self._made = self._make(), True
return self._value
def with_dependencies(facts):
"""The facts with the modules the checked module depends on read as well.
None when there is nothing more to read: a fieldtest walk read the whole
tree already, and a module whose dependencies are not to be found, or
come to more than the cap, has nothing to add.
"""
more = (facts or {}).get("with_dependencies")
return more() if more else None
def _dependency_sources(manifest, addons=()):
"""The Python files of every module this manifest's module depends on,
transitively, that can be found: manifests included, tests left out.
A dependency is looked for beside the module first, in the same directory,
where an addons path keeps its modules, then in each directory of `addons`
in turn, the first one holding it winning, as Odoo's --addons-path does.
One installed anywhere else is not looked for, so for a module of Odoo
core `base`, which core keeps apart from the rest, is read only when it is
named. Breadth first and in name order, so a walk reads the same files
every run. Nothing at all when they come to more than _CLOSURE_FILE_CAP:
`check` then has the facts of the module alone, which can leave a finding
standing and never makes one.
"""
root = os.path.dirname(os.path.abspath(manifest))
places = [os.path.dirname(root)] + [os.path.abspath(a) for a in addons]
seen = {os.path.basename(root)}
queue = sorted(_manifest_depends(_read(manifest)))
found = []
while queue:
module = queue.pop(0)
if module in seen or not _MODULE_NAME_RE.match(module):
continue
seen.add(module)
declared = next((m for m in (_manifest_in(os.path.join(place, module))
for place in places) if m), None)
if declared is None:
continue
directory = os.path.dirname(declared)
queue.extend(sorted(_manifest_depends(_read(declared))))
for dirpath, dirnames, filenames in os.walk(directory):
dirnames[:] = sorted(d for d in dirnames
if d not in _SKIP_DIRS and d.lower() not in _TEST_DIRS)
found.extend(os.path.join(dirpath, filename) for filename in sorted(filenames)
if filename.endswith(".py"))
if len(found) > _CLOSURE_FILE_CAP:
return []
return found
def _manifest_in(directory):
"""The manifest a module directory holds, or None when it holds none."""
for name in MANIFEST_NAMES:
candidate = os.path.join(directory, name)
if os.path.isfile(candidate):
return candidate
return None
def is_demo_data(path):
"""Is this file listed under its module manifest's `demo` or `demo_xml`?
Odoo loads demo files with noupdate forced on (odoo/modules/loading.py:
"noupdate is False, unless it is demo data"), so a record in one is never
rewritten by an upgrade, whatever the file itself says. A file whose
manifest cannot be found or read is not demo data as far as this can tell.
"""
manifest = _walk_up(path, MANIFEST_NAMES)
if not manifest:
return False
try:
declared = ast.literal_eval(_read(manifest))
except (ValueError, SyntaxError, TypeError):
return False
if not isinstance(declared, dict):
return False
root = os.path.dirname(manifest)
target = os.path.normcase(os.path.abspath(path))
for key in ("demo", "demo_xml"):
for rel in declared.get(key) or ():
if isinstance(rel, str) and os.path.normcase(
os.path.abspath(os.path.join(root, rel))) == target:
return True
return False
def parent_is_deleted(facts, model):
"""Does anything actually delete `model`?
PRESENT the tree deletes it: an unlink call, an unlink override, or an
access rule granting perm_unlink.
ABSENT the tree DEFINES the model and never deletes it anywhere. Master
data, as far as this codebase is concerned.
UNKNOWN no tree was walked, or the model is not one this tree defines.
The ABSENT bar is deliberately the strict one, and has two conditions. The
model must be one this tree DEFINES: a model reached by `_inherit` belongs to
core Odoo or to a module this walk never saw, so a relation to res.partner
reads UNKNOWN however much of the tree was read. And the walk must have been
complete, because a module-sized walk cannot see the other module that does
the deleting.
"""
if not facts or not facts.get("walked") or not model:
return UNKNOWN
if model in facts["models_deleted"]:
return PRESENT
if model in facts["models_declared"] and facts.get("complete"):
return ABSENT
return UNKNOWN
def multi_company_in_use(facts):
"""Does this codebase run more than one company?
PRESENT if the tree shows the machinery -- a user in several companies, code
reading the active set, an existing check_company, a company record rule.
ABSENT if a tree was walked and shows none of it. UNKNOWN if none was.
"""
if not facts or not facts.get("walked"):
return UNKNOWN
if facts["multi_company"]:
return PRESENT
return ABSENT if facts.get("complete") else UNKNOWN
def describe(ctx):
"""One line per known fact, for the prompt and for the evidence bundle."""
lines = []
if ctx.get("module"):
lines.append("Odoo module: {0}".format(ctx["module"]))
if ctx.get("odoo_series"):
lines.append("Odoo series: {0}".format(ctx["odoo_series"]))
if ctx.get("models"):
lines.append("Models in this file: {0}".format(", ".join(ctx["models"])))
if ctx.get("odoo_imports"):
lines.append("Already imported from odoo: {0}".format(", ".join(ctx["odoo_imports"])))
if ctx.get("is_test"):
lines.append("This file is a test, so throwing on bad input is acceptable here.")
return lines
if __name__ == "__main__":
import sys
if len(sys.argv) > 1:
print(json.dumps(from_file(sys.argv[1]), indent=2))
else:
print(__doc__)