Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reflexion on the french SAPIN LAW application #105

Closed
flotho opened this issue May 16, 2017 · 131 comments
Closed

Reflexion on the french SAPIN LAW application #105

flotho opened this issue May 16, 2017 · 131 comments
Labels
stale PR/Issue without recent activity, it'll be soon closed automatically.

Comments

@flotho
Copy link
Member

flotho commented May 16, 2017 •
edited
Loading

Dear Community,

I would like to start a thread regarding the SAPIN french law. From now the french administration is not really explicit about the ways to certify the Odoo solution. Does anyone has some legal info?

Here are some of the resources I found :

Some part of the law seems to be easy to certify : Hosting / Backup / Recovery are easy for the community partners to be certified.

Regarding the durability of the datas I think we have a problem with the POS. From now the POS has been designed to be working without network and all the datas are stored inside the browser database. This point could be an issue if you consider how easy it is to get the datas from the internal database (and what about the debug mode allowing to flush the orders!!!)
I have some little ideas on those points :

  • Find a way to block some inappropriate operation from the POS (like in debug mode)
  • Find a way to store every transaction in the POSBox from the POS
  • Find a way to protect the browser database with encryption
  • Find a way to deliver browser application with options preventing the user from acceding to the internal database.

None of those solutions looks enough for me(everything in the client part could be changed by an experienced user/ ethic hacker).

Odoo seems to have started a reflexion on this : https://github.com/odoo-dev/odoo/commits/9.0-l10n_fr-certification-lpe . It looks like Odoo is considering that only the account_cancel module could be a problem.

Some partners have started a reflexion, (BTW thanks to Sébastien Morelle) : https://anybox.fr/blog/logiciels-de-caisse-certifies

Maybe we could start a thread here https://odoo-community.org/groups/france-24

Any feedback would be appreciated.

Regards
@sisalp
Copy link

sisalp commented May 16, 2017 •
edited
Loading

hello,
this is the most operational document I know about this: http://brochures.sisalp.fr/referentiel-certification-systemes-caisse.pdf

Some comments

  • The POS is obviously a big issue. In my opinion, it requires deep reconsideration. At first, just don't use it at all.
  • The account_cancel is another problem, but not for this law : rewriting accounting journals has been forbidden in France for past 500 years, it is just a patch to come back on track with legal accounting.

Some people do register payments using Odoo, in particular they consider that they can give the invoice at the desk and register the payment by setting the "paid" status of the invoice. They are wrong, already today. They must conform to payment regulations now, independently of this law. In particular it is true for non-VAT business which is not concerned by the new rule.

The law now underlines these obligations and requires tools used to register payments to get certified. This is the only new point compared with today situation.

People who are correct today, I mean who register their payments on a cash register or a paper book can keep on, no change.
People who used Odoo to register their payments should immediatly register them outside Odoo. Buy a cah register of a receipt official book.
People who are using the POS have a problem. They can

  • get a certificate from someone. Someone can be Odoo if they move to last enterprise, provided that we trust in Odoo capability to certify the Enterprise edition. Or someone can be a third party like Anybox, but here also we must be sure Anybox does understand the certification process, which their paper doesn't show (I made the same mistakes before I studied it deeper).
  • replace the POS by another certified solution, for exemple by interfacing a cash register to Odoo.

Hope this helps.

@sebastienbeau
Copy link
Member

@flotho regarding the point of sale on our side we think about

With that solution we are sure that no POS can be lost during the synchronization as the ticket will be generate only after the synchronization (and maybe we can generate it on server side so you can reprint a ticket from the backoffice easily).

We can also print the first letter/digit of the hash on the ticket, so every ticket are a proof of the inalterability.
On pure accounting side we also work on module to edit invoice after the validation for the field that do not impact your accounting so we can drop account_cancel

@legalsylvain
Copy link
Contributor

Hi @flotho,

Thanks a lot for beginning this thread ! We could in a first time enumerate each point, and after create little workshops for each point. I see the following points.

  1. Developpers - Accounting Part : Secure accounting modules. Blocking account_cancel module, etc...
  2. Developpers - PoS Part : Secure PoS features. Basically, what you said.
  3. Admin - Hosting Part : what we have to do regarding hosting. (forbid admin access, etc...)
  4. Legal - Customer Part : what kind of documents we have to give to the customers. A community module to generate pdf could be welcome.
  5. Legal - Self Hosting Part : Most of us are selling Odoo for customers, but we have an instance for us. Is it self-certification allowed ?

do you see other points ? Thanks.

CC

kind regards.

@qdp-odoo
Copy link

Please, let us know your conclusions: on our side, so far, we don't plan to do anything more than the current l10n_fr_certification module proposition (except a signed document by Fabien certifying Odoo)

best regards

@sisalp
Copy link

sisalp commented May 17, 2017

Quentin : do you mean Odoo Enterprise will not pass through certification process ?

@fmdl
Copy link
Contributor

fmdl commented May 17, 2017

I think there are an other point : it the software fingerprint.
In page 8 of http://brochures.sisalp.fr/referentiel-certification-systemes-caisse.pdf, the certifcation need the software fingerprint. it is possible to calculate the fingerprint of odoo code and compare with the fingerprint save on Odoo website. (that like fiscal administration can know if
But there are an issue with the external addons, every addons can access to every methode, I don't know if it is possible with python to protect the account methode. (or protect cr.execute)

Maybe use https://www.postgresql.org/docs/current/static/pgcrypto.html or http://docs.postgresql.fr/9.2/ssl-tcp.html to crypt database.

@alexis-via
Copy link
Contributor

I propose we speak about this during the OCA code sprint in Barcelona https://odoo-community.org/event/barcelona-code-sprint-2017-05-29-2017-05-31-58/register It will be a good opportunity to exchange our ideas and update the status of the work on this. At Akretion, we already started some devs on this topic and we will continue (maybe during the code sprint too).

@alexis-via
Copy link
Contributor

For those who missed the info : https://www.lesechos.fr/thema/030387673950-revirement-bienvenu-en-matiere-de-logiciels-certifies-2094788.php
The law will be changed and should only target POS software (not accounting software).

@legalsylvain
Copy link
Contributor

I just made a PR to manage certification for PoS. (and for account, even if it does'nt seems necessary anymore, given the last @alexis-via remark).
Thanks for your review.

#108

@flotho
Copy link
Member Author

flotho commented Jul 8, 2017

Thanks to the community for the tips http://proxy-pubminefi.diffusion.finances.gouv.fr/pub/document/18/22503.pdf

@flotho flotho mentioned this issue Jul 12, 2017
Open
@Auneor
Copy link

Auneor commented Jul 21, 2017 •
edited
Loading

Hi everyone
How about centralizing/synchronizing the dev/discussions between all partner? I think the complexity of the law/devs needed make it difficult to have everything in a single thread like here.
So some devs have been done in order to backport the odoo module l10n_fr_certification and make the pos compliant for v8 #108
I think there is still some problems, with the approach that odoo propose; indeed, nothing is proposed to close an accounting period, see the point 110 in http://bofip.impots.gouv.fr/bofip/10691-PGP
Another problem, is with a test/demo database, that must modify reports and pos tickets to include "TEST" or "FACTICE" (point 150 from the previous URL)
I didn't see anything done in l10_fr_certification for v9/10 to secure/hash PoS operation like payments, bill emited, I think it's critical and needed to comply with the law (point 130 and 140)
We made a github repository here https://github.com/MohammedAuneor/lf2016 (because we didn't find this thread here when we decided to do it) but we are open to move the discussion somewhere else, here, or on other support.
The approach I was thinking was more to use a global table with hashes for all the application, and to choose more carrefully what is hashed and stored in a secure/inalterable way. The only problem I see is with the point 220, that says: Elle doit prévoir un dispositif technique garantissant l'intégrité dans le temps des archives produites et leur conformité aux données initiales de règlement à partir desquelles elles sont créées.
Regards

@legalsylvain
Copy link
Contributor

Hi @MohammedAuneor,

Welcome in the community.

How about centralizing/synchronizing the dev/discussions between all partner? I think the complexity of the law/devs needed make it difficult to have everything in a single thread like here.

Well, this thread has a avantage to join various people of the OCA community. Let's go continuing with this, and if we have to create later work group, it will be more easy.

I think there is still some problems, with the approach that odoo propose; indeed, nothing is proposed to close an accounting period, see the point 110 in http://bofip.impots.gouv.fr/bofip/10691-PGP

Accouting is now out of the scope of the law, just Point of sale. See @alexis-via comment. (#105 (comment)).
Anyway, this part should be out of the l10n-france thread, because many countries require to close accounting period, and it's a global problem.
And even if, it is managed by the module l10n_fr_certification_account, (#108). As all the entries are ordered, it is trivial to check that an 2016 entry has been written in 2017.

Another problem, is with a test/demo database, that must modify reports and pos tickets to include "TEST" or "FACTICE" (point 150 from the previous URL)

Good idea ! for me, it's optional, because not all configurations provide test / demo servers.
But overloading all report will be a mess, and will not be very secure, as it's possible for end user to edit custom report.
What about a more light approach ? As company name is set on all the report and bill, It will be more easy to just rename your company, or to have a little module, depending on xx_environment OCA / server-tools module that overload name_get function of res.company, to add (DEMO) at the end of the name.

I didn't see anything done in l10_fr_certification for v9/10 to secure/hash PoS operation like payments, bill emited, I think it's critical and needed to comply with the law (point 130 and 140)

Indeed, we have to port l10n_fr_certification_pos module. Feel free to review #108. It should be cool to have a stable 8 version, before porting it. and it will not need a lot of work.( some JS work)

The only problem I see is with the point 220, that says: Elle doit prévoir un dispositif technique garantissant l'intégrité dans le temps des archives produites et leur conformité aux données initiales de règlement à partir desquelles elles sont créées.

I don't understand that point. This is a matter of adminsys people, to grant backup. What do you propose ?

Thanks for your comment.
kind regards.

@sisalp
Copy link

sisalp commented Jul 21, 2017 via email

@legalsylvain
Copy link
Contributor

Hi @sisalp. Please, be more precise.

  1. What do you propose ?
  2. Whad did you plan to do for your enterprise ?

regards.

@sisalp
Copy link

sisalp commented Jul 21, 2017 via email

@jcchoquet
Copy link

jcchoquet commented Sep 7, 2017 •
edited
Loading

For those who missed the info : https://www.economie.gouv.fr/files/files/directions_services/dgfip/controle_fiscal/actualites_reponses/logiciels_de_caisse.pdf
Accouting is in of the scope of the law, for people not subject to VAT.

@fgi-odoo
Copy link

fgi-odoo commented Oct 16, 2017 •
edited
Loading

We are going to upgrade l10n_fr_certification for POS module in order to be compliant with the new legislation that we read carefully. This new module will be released asap and will be available for versions 9, 10 & 11.

Here are the functionalities we plan to cover:

  • no way to cancel POS orders and journal entries
  • no way to cancel or modify the balance of payment journal statements (access from POS sessions)
  • hash computation on POS orders and journal entries
  • interface to check the inalterability of POS orders and journal entries
  • Computation of payment period's grand total (daily, weekly, monthly periods) > new object
  • download of the mandatory certificate (only available for Odoo Enterprise & Online)

Is there anything else we should take into account? Have you already developed new modules covering those aspects? Your feedback will be much appreciated. Thanks!

@sisalp
Copy link

sisalp commented Oct 16, 2017 via email

@legalsylvain
Copy link
Contributor

Hi @fgi-odoo. Thanks a lot to ask to the community. Very appreciated. Are you responsible of Point Of Sale in Odoo ?

The point are pretty clear for me, except two :

  • cumulative sessions for POS (daily, weekly, monthly) + computation of session's grand total

Are talking about the possiblity to generate pdf with daily / weekly / etc.. information ? Not sure to understand.

  • download of the mandatory certificate (only available for Odoo Enterprise & Online)

Are you talking about the possibility to generate via Odoo the certificate. (pdf too).

thanks for your precision.

kind regards.

@legalsylvain
Copy link
Contributor

@sisalp : your document is outdated. Don't it ? (décembre 2016)

After the election of Macron, see @jcchoquet remarks. If you find a up-to-date document, please share to the community.

regards.

@jcchoquet
Copy link

Hi @fgi-odoo,
if you see this link : https://www.economie.gouv.fr/files/files/directions_services/dgfip/controle_fiscal/actualites_reponses/logiciels_de_caisse.pdf
it is not only the POS of concerned, but also the customer payments in Odoo...

@sisalp
Copy link

sisalp commented Oct 16, 2017 via email

@sisalp
Copy link

sisalp commented Oct 16, 2017 via email

@jcchoquet
Copy link

when I have contacted the DGFIP for this law, i have this response :
image

@legalsylvain
Copy link
Contributor

Hi @jcchoquet thanks a lot for your link.

regards.

@fgi-odoo
Copy link

fgi-odoo commented Oct 17, 2017 •
edited
Loading

@legalsylvain yes I'm the product owner for all the sales apps (sales, pos, ecommerce, etc.).

@jcchoquet: for now balance of POS payment journals can be edited from the Accounting menu since statements stay in draft as long as you don't close the session. So the idea is to prevent the editing of such draft statements if they relate to POS journals. Therefore the only way to make corrections is through the frontend with plus and minus operations, as stated in the new regulation.

@jcchoquet
Copy link

@fgi-odoo : the new regulation is not only for cash but for all methods of payment (see topic 11 of link)
for me, Accounting is in of the scope for the sales "BtoC".

@fgi-odoo
Copy link

fgi-odoo commented Oct 17, 2017 •
edited
Loading

@jcchoquet Indeed! So we will stick to the initial plan and prevent users from cancelling any journal entry, including confirmed account payments.

@jcchoquet
Copy link

the certification will be made also for the community version ?

@flotho
Copy link
Member Author

flotho commented Nov 17, 2017

Ok, @robinshakty, thanks for your comment,
If you tested the #108, could you put some comment or result test on it so that @legalsylvain and the community could have some feedback.
Additionally, regarding testing this #108, what do you think about my tests proposal #105 (comment)

@fgi-odoo
Copy link

Thanks @robinshakty for your feedback! Has anybody else tested it? Thanks!

@legalsylvain
Copy link
Contributor

Hi @fgi-odoo, I already reviewed it directly on the PR odoo/odoo#20581
regards.

@tkFontaine
Copy link

Odoo will give a module for the certification for Odoo community, but it means that we have to obtain certification on our own, right ?
Will you provide us all documents (or a part) for the certification ? One of organization (LNE) list all documents here at page 8.

@fgi-odoo
Copy link

@robinshakty thanks a lot for your suggestions.

Why would it be better to process a sales closing at the closing of a pos session? You might close your POS several times a day or have several sessions running at the same time. It would considerably increase the number of sales closings. If it's only for control reasons, is it not acceptable to launch the cron manually? This will be explaned in the user doc.

Then regarding the xml file, this is adding a new layer of security (with another hash computation on the file I guess) that can hacked as well by a "man of the art". Also this extra process would slower the recording a pos order. The initial # computation makes it already a bit slower. So I'm not sure we should do that. A man of the art will always be able to change the hash, whatever you do to prevent it.

@fgi-odoo
Copy link

@tkFontaine yes you got it. Odoo will provide a user guide with some technical hints. Here is the draft: https://docs.google.com/document/d/1zAA_Qe2H7fCPvGbH_ztuMoNNzmT3xOmX__xF5Ugi2F8/edit?usp=sharing

@robinshakty
Copy link

Hi @fgi-odoo,
thank you for your responses and questions.
Why would it be better to process a sales closing at the closing of a pos session?
-> Because the sessions have to be closed every day and the software has to block new sales in an old session. You dit it well, and the law wrote that the user must use a system which has to calculate daily grand totals, not when he think, or forget, or decide ...
It is why I suggested this possibility.

The idea of the hashed xml file is to have a hashed data out of the (backup of) the database, to maintain inalterability even after a restore of a database, with the possibility to sync with a digital safe (via rsync or ftp), and we would solve the problem of a 'man of the art' because hashed datas woul be secure by another 'real' and independant Certificate Authority.
I know that the law did not force this, but any ineltaribility with no independant Certificate Authority is 'relative', so is not 'ineltaribility'.

@fgi-odoo
Copy link

@robinshakty Ok, a user will not be able to resume a pos session after more than 24 hours. This will force them to process daily closings and so, to include pos sales into daily sales closings. There can be a gap of one day of course, if the sales closing occurs before the pos closing. But this can be easily figured out thanks to datetime fields on both objects. We don't see that as a problem.

Regarding the xml file I keep this nice suggestion to improve the module in master afterwards.

@fgi-odoo
Copy link

Here is our official statement: https://www.odoo.com/fr_FR/blog/notre-blog-5/post/obtenez-la-certification-anti-fraude-a-la-tva-avec-odoo-464.

The module will be available very soon.

@sisalp
Copy link

sisalp commented Dec 13, 2017 via email

@tkFontaine
Copy link

tkFontaine commented Dec 15, 2017 •
edited
Loading

@fgi-odoo Thank you for your work.
I tested your module, and I can't Check data inalterability on an existing database. I mean, I want to test your module on an database where there are already sales.
First, I clicked on Data Inalterability Check (on POS), then I got the message

There isn't any order flagged for data inalterability yet for the company Crocali. This mechanism only runs for point of sale orders generated after the installation of the module France - Certification CGI 286 I-3 bis. - POS

Then I closed the session actually open, and I reopened a new one, did some sales and closed it again. But I still get the same message . Is there a configuration to do ? Is it a problem if there are already old sales before install modules ?

Edit: I selected the wrong country.

But there still a question Is it a problem if there are already old sales before install modules ?

@fgi-odoo
Copy link

@sisalp We made sure to comply with every single requirement of the new law. So we are confident in delivering the certificate ourself. By law it is also forbidden to communicate anything about any certification process.

@tkFontaine all the old sales should be encrypted when you install the module.

@sisalp
Copy link

sisalp commented Dec 18, 2017 via email

@odony
Copy link

odony commented Dec 18, 2017 via email

@sisalp
Copy link

sisalp commented Dec 18, 2017 via email

@tkFontaine
Copy link

@fgi-odoo By law it is also forbidden to communicate anything about any certification process.

Will it includes all documents required for certification ? If yes, it means that we have to provide those documents by ourself ?

Last question, but not the least : Can someone tell me the difference between "certificat" and "attestation individuelle" ?

@Yakulu
Copy link

Yakulu commented Jan 4, 2018

@tkFontaine there are detailed elements on BOFIP, around paragraph 350 http://bofip.impots.gouv.fr/bofip/10691-PGP

@fgi-odoo
Copy link

As discussed here a few months ago, printing the hash on the ticket is needed to avoid offline fraud (cfr odoo/odoo#16935 (comment)). We are working on such an improvement for the l10n_fr_pos_cert module. The ticket printing will therefore require to be online.

When it comes to restaurants, we need your opinion regarding pro forma printings. For now, you can take an order, print the pro forma and delete the order without registering the payment. This seems to go against the new legislation requiring to make inalterable any order update with + and - operations (items 20 of the FAQ https://www.economie.gouv.fr/files/files/directions_services/dgfip/controle_fiscal/actualites_reponses/logiciels_de_caisse.pdf).

As a solution, we think of recording all the printings in the backend (attached to the pos order) and prevent from deleting orders already printed in pro forma. That way, any update or deletion operation will be printed, saved and encrypted.

Do you agree on the solution? Thanks!

@legalsylvain
Copy link
Contributor

Hi @fgi-odoo. Thanks a lot for sharing your insights !

As discussed here a few months ago, printing the hash on the ticket is needed to avoid offline fraud (cfr odoo/odoo#16935 (comment)). We are working on such an improvement for the l10n_fr_pos_cert module. The ticket printing will therefore require to be online.

Regarding the print of the hash on the bill, I worked some monthes ago on that feature.
The description is available here

  • Could you contact me to see if it's possible to include this work or part of this work into the Odoo Core ?
  • I think it will be valuable to keep the "warning" feature for the PoS. Offline mode should be a possibility. Otherwise, Odoo PoS will not be a choice in France. We can not propose a PoS that doesn't work if there is a network problem.

image

As a solution, we think of recording all the printings in the backend (attached to the pos order) and prevent from deleting orders already printed in pro forma. That way, any update or deletion operation will be printed, saved and encrypted.
Do you agree on the solution? Thanks!

prevent from deleting orders

+1 in the JS part. We could add a flag on order lines, that indicate that order line has been printed.

recording all the printings in the backend

Is it necessary ? If the order lines can not be deleted or altered, once printed. The order will be validated. don't you think ?

Other problem I see, unfortunately, in Bar and restaurant, sometimes, the waiter will give the "profarma", and the customer will go without pay. (This occures in France;-)). I think we should handle this case with an option to validate a pos order, but not paid. (something like with a Profit / Loss mechanism).

Kind regards.

@legalsylvain
Copy link
Contributor

HI @fgi-odoo. Did you take a look on my last comment ?
kind regards.

CC @mart-e

@legalsylvain
Copy link
Contributor

@fgi-odoo, @mart-e. No news about possible collaboration ?

@mart-e
Copy link

mart-e commented Aug 9, 2018

Hi,

As discussed by email, we would gladly collaborate on this 🙂
We do plan to add the signature. Having a warning if offline seems a good intermediate solution.
Let's work on this !

@legalsylvain legalsylvain mentioned this issue Aug 10, 2018
Closed
9 tasks
@rgeromegnace
Copy link

The module will be available on community version of course. As long as Odoo provides the certificate, this will be only for Enterprise users. However we plan to get certified by an official certifier early 2018. If this really happens the certifier would distribute the certificate to any Odoo user.

Hello, I read all threads. What about the official certifier for Odoo Pos Community?

Regards,

@rgeromegnace
Copy link

Any answer @fgi-odoo ?

Regards

@fgi-odoo
Copy link

fgi-odoo commented Dec 7, 2018

@rgeromegnace Modules used for the certification are available in the community version. But the certificate is only provided to Odoo Enterprise Users, as it implies a strong commitment from the editor (see https://www.odoo.com/fr_FR/blog/notre-blog-5/post/mise-en-conformite-de-votre-systeme-odoo-pour-la-nouvelle-legislation-anti-fraude-a-la-tva-464). If you run the community version, you should issue the certificate yourself or ask an integrator.

@rgeromegnace
Copy link

@rgeromegnace Modules used for the certification are available in the community version. But the certificate is only provided to Odoo Enterprise Users, as it implies a strong commitment from the editor (see https://www.odoo.com/fr_FR/blog/notre-blog-5/post/mise-en-conformite-de-votre-systeme-odoo-pour-la-nouvelle-legislation-anti-fraude-a-la-tva-464). If you run the community version, you should issue the certificate yourself or ask an integrator.

Thanks for your reply even if it is late. I thought that there were partners or integrator that sold the module and that managed the certification.

Regards,

@github-actions
Copy link

There hasn't been any activity on this issue in the past 6 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days.
If you want this issue to never become stale, please ask a PSC member to apply the "no stale" label.

@github-actions github-actions bot added the stale PR/Issue without recent activity, it'll be soon closed automatically. label Oct 31, 2021
@github-actions github-actions bot closed this as completed Dec 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
stale PR/Issue without recent activity, it'll be soon closed automatically.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests