Skip to content

OD607 private-rpc-method

orm.call() names a private method, which Odoo refuses to call over RPC.

Category Severity Series Needs the index
Correctness Error all no

What it reports

A call orm.call(model, method, ...) whose method is a literal starting with _, whatever the model, a literal or an expression such as this.props.resModel. The service is recognised as for OD603, through orm.silent and orm.cache() too.

Why it matters

The server refuses to dispatch a method whose name starts with _ and answers with an AccessError the user sees as a dialog, every time the call runs, even when the model has it. Such a method is meant for Python callers only. The usual cause is a client calling the helper behind a public method, rather than the public method or a new one the module adds to wrap it.

OD604 leaves these calls to this rule, so a private method the model does not have is reported once, here.

Example

static/src/js/post_button.js
await this.orm.call("account.move", "_post", [[this.props.record.resId]]);

_post is the helper behind posting an entry: the method the client may call is action_post.

static/src/js/post_button.js
await this.orm.call("account.move", "action_post", [[this.props.record.resId]]);

Suppressing

// odooscan: ignore[OD607]
await this.orm.call("account.move", "_post", [[this.props.record.resId]]);

See suppressing a finding.