| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
Discuss (mail)
|
| Lines of code | 845 |
| Technical Name |
no_access_pass |
| License | OPL-1 |
| Website | https://www.oudayet.com |
| Versions | 16.0 17.0 18.0 19.0 |
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
Discuss (mail)
|
| Lines of code | 845 |
| Technical Name |
no_access_pass |
| License | OPL-1 |
| Website | https://www.oudayet.com |
| Versions | 16.0 17.0 18.0 19.0 |
Access Pass
Time-limited privilege elevation, with the timer built in.
The pile-of-permissions problem
What you get
Bundle security groups into reusable profiles — "Accounting Manager", "HR Admin", "Finance Closer". Each profile carries a risk level, a max duration, and an optional approver list.
Set a start datetime and an end datetime. The cron activates the grant when the window opens and revokes it when the window closes — no manual cleanup, no forgotten permissions.
Draft → Approved → Active → Expired or Revoked. Self-approval is blocked at the model level — the target user can never sign off on their own elevation.
Only the groups added by the grant are removed at expiry. Pre-existing groups are preserved. Groups still claimed by another active grant on the same user are protected.
Every action — request, approve, reject, activate, revoke, expire — is logged with timestamp, performer and notes. Records cannot be edited or deleted; only sudo() can create them.
A scheduled action runs every five minutes to activate approved grants whose start has passed and to expire active grants whose end has passed. Configurable in Settings → Technical → Scheduled Actions.
When you reach for it
Your accountant needs Manager rights for two days to close the books. Create a grant, set the window, get a sign-off, walk away. Permissions revert on Wednesday morning.
A team lead is on PTO for ten days. Their backup needs the same approver permissions for that exact window. One grant captures the duration; nothing leaks past the return date.
A consultant needs Settings access for a 30-minute migration. Grant the elevation profile for one hour, audit logs the whole session, and the consultant loses access before they hang up.
Your auditor asks who had elevated access in Q3 and why. The audit log answers in one screen: every grant, every approver, every reason — immutable, time-stamped, and exportable.
How it works
Open Access Pass → Configuration → Elevation Profiles. Bundle the security groups, set max duration, list approvers (optional).
Pick the profile, the target user, the time window, and a reason if the profile demands one. The grant lands in Requested.
An approver signs off. The cron snapshots current groups, adds the new ones at start, and removes only what it added at end.
Installation
cp -r no_access_pass /opt/odoo/addons/
# restart odoo and update apps list
# then install Access Pass from the Apps menu
# tick the "Access Pass / Manager" group
# only managers can approve, activate or revoke grants
Works with
Sales, Accounting, HR, Inventory, custom modules — if it ships a security group, you can elevate it.
Grants surface a chatter. Activity scheduling lets approvers track follow-ups.
Activation and expiration are stock ir.cron jobs — tweak the interval or trigger them on demand.
Community and Enterprise. Multi-company-aware via the standard groups model.
Honest scope
- ✗ Record-rule level elevation — this module elevates security groups, not row-level domain rules.
- ✗ External-system credential injection — nothing is sent outside Odoo.
- ✗ Multi-step approval chains — one approver per grant.
The 5-minute cron interval is a deliberate ceiling for activation latency. Need shorter? Lower the interval in Settings → Technical → Scheduled Actions. Activations take effect on the user's next login or by Odoo's own group-cache refresh, whichever comes first.
Audit trail you can show an auditor
The access.pass.audit model is append-only. write() and unlink() raise AccessError. Direct create() raises too — only sudo() from _log_audit() can write entries, so even a compromised manager account cannot rewrite history. Self-approval is blocked at the model level: env.user == user_id raises UserError on action_approve.
FAQ
Activation only adds the groups the user is missing. The grant tracks exactly which groups it added in granted_group_ids, and revocation removes only those.
Yes. When one expires, the smart-revocation logic checks the other active grant's profile and protects any group still claimed by it.
Yes — Settings → Technical → Scheduled Actions → Access Pass: Process Elevation Grants. You can also trigger it manually from the same screen.
The grant and audit tables are dropped. Active grants will not auto-revoke, so revoke them before uninstalling, or rely on a manual cleanup of the affected users' groups afterwards.
Yes — security groups in Odoo are global, so a grant works across the user's entire scope. Profiles can be created per company through the standard res.groups model.
Technical details
no_access_passOdoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module