Security model
What Dead Stock & Inventory Ageing can read and write, what it stores, and what leaves your instance.
What the module can reach
The report is a read-only PostgreSQL view. It has no INSERT, UPDATE or DELETE path at all — not because the ACLs forbid it, but because there is nothing underneath to write to. The ACLs grant read only, so an attempt to write fails with a clear Odoo error rather than a database one. Both are covered by tests.
The module never writes to stock_quant, stock_move_line, product_product or any other existing table.
Access control
| Model | Group | Rights |
|---|---|---|
| stock.dead.stock.report | Inventory / User | Read |
| stock.dead.stock.wizard | Inventory / User | Read, write, create, delete (it is a transient form) |
Users with no Inventory group cannot read the report at all.
Odoo's own Inventory → Reporting menu is restricted to Inventory Administrators, so that is who reaches the report through the menu. The model itself is readable by Inventory Users so the report can be embedded or linked without granting administrator rights.
Multi-company
A global record rule restricts every read to
company_id = False OR company_id IN company_idsGlobal, not group-based, so it applies to every reader regardless of their groups. Without it a database view carries no company restriction of its own, and a user in one company would read another company's stock levels and its valuation. There is a test that asserts exactly this.
Product cost is read per company from the company-dependent standard_price column, so a two-company database never values one company's stock at another's cost. That is tested too.
What the module never does
- No outbound network calls.
- No external Python dependencies.
- No monkey-patching of core Odoo classes.
- No sudo() on anything a user reads. sudo() appears only in the weekly digest cron, which by design has to see every company, and in reading two configuration parameters.
- Nothing is logged except a digest count and genuine errors. No product, quantity or valuation is ever written to the server log.
The weekly digest
The digest is the only part of the module that sends data anywhere. It contains warehouse names, line counts and value totals — no product names, quantities or costs. It is built per company and addressed only to recipients who belong to that company.
It is off by default. Turning it off again stops it immediately; the scheduled action stays but does nothing.
Reporting a vulnerability
Email info@technovision.dev. Please do not open a public issue.