I was setting some rules to the party to allow access only to some parties, and to those party, allow to read, but not write/create/delete.
After checking the results I see that I can edit the address of those parties and the contact mechanism.
I solved by setting cls.__access__.add('party'), is this access something that should come from default on this models?
For me it will be wrong to consider an address as being a sub-part of a party. The addresses are used as independent document in the system.
Why? The address is related to a party. So if you alter the address you are altering some of the party properties.
Another thing is that a party may have multiple addresses so we need a different document to store them.
Related does not means part of.
An invoice is related to a party but it is not part of the party. This is the same for address.
But when you issue an invoice to a party you do not change any of its properties.
When you change the address of such party this means that the party is no longer available on some place but in another.
For me the address is part of the party but not the invoice.
If you want but we are not going to make address inherit access from party. There are not reason to link their access and only create more difficulty for implementation.
Indeed we are raising this issue because it makes it more dificult to customize the access rights for the party and its related models.
But as far as there is no access rules defined por parties, addresses and contact mechanisms on default implementation the issue is not present there.
Having said that if you do not want to discuss nor change it we will keep or custom implementation as it fixes the issue for us.
No it does not because you can do it. The reverse is not True.
There are no justification to have such access bound for independent document. And the proof they are independent is that they have their own menu entry.
Proof that you can customize.