Macrohat Admin Lockdown
Only nominated administrators may install, upgrade or remove apps, enforced on the server.
£ 249.00
£ 249.00
Invalid email
Macrohat Admin Lockdown
Only nominated administrators may install, upgrade or remove apps, enforced on the server.
Out of the box, every Odoo user with Settings access can install, upgrade or uninstall apps on a live database. On most business databases that is too broad: the person who configures users, taxes and journals is rarely the person who should be adding modules to production.
This module narrows app management to one App Manager group. Everyone else loses the Activate, Upgrade and Uninstall controls in the Apps screens, and the methods behind those controls refuse them on the server, so the restriction holds over the API as well as in the interface. Hiding a button is not a security control on its own; this is.
Deployments are unaffected: command-line installs and upgrades, module auto-install and Odoo's internal flows run as the superuser and keep working. It depends on Odoo's base module only and stays installed through a move from Community to Enterprise.
- One group holds the keys
- App management is confined to an App Manager group that ships with the built-in Administrator only. Add people in Settings, Users & Companies, Groups.
- Enforced on the server
- The install, upgrade and uninstall methods check the group themselves, so a user who calls them over the API is refused just as one who looks for the button is.
- The catalogue stays readable
- Administrators outside the group can still browse Apps and read module records. Only the actions that change the database are gone.
- Fails closed
- If the group record is ever missing, nobody but the superuser can manage apps. The lockdown never falls open.
- Membership survives upgrades
- The group is created once and never reset by a module upgrade, so the people you nominate stay nominated.
| Group | App Manager, seeded with the built-in Administrator only |
|---|---|
| Interface | Activate, Upgrade and Uninstall hidden for non-members in the Apps form, list and kanban views |
| Server | Install, upgrade and uninstall methods raise an access error for non-members |
| Superuser and CLI | Always allowed, so command-line deploys keep working |
| Failure mode | Fails closed: if the group is missing, every non-superuser call is refused |
| Platform | Version Released |
|---|---|
| Odoo 20 | 20.0.1.0.0 11/10/2026 |
| Odoo 19 | 19.0.1.0.0 01/10/2026 |
Will it stop our own deployments?
No. Installs and upgrades run from the command line, module auto-install and Odoo's internal flows run as the superuser, which is always allowed.
What happens if we move to Enterprise?
Nothing. It depends on Odoo's base module only, touches nothing Enterprise provides, and should stay installed.
What happens on uninstall?
App management returns to Odoo's default, where every Settings user can manage apps. The group's membership is not kept, so note who is in it first if you intend to reinstall.