[IMP] hr_expense : improve access rights of manager/officer

Currently the distinction between expense officers and expense managers
doesn't make sense because they both have the same rights.

This commit aims at making a clear difference between an officer and a
manager.

After this commit the rights will look like this :

  * Expense Manager :
  	- See and approve any expense

  * Expense Officer :
  	- Can see and approve the expenses of employees in his department
	  or employees for which he is the manager (field parent_id on
	  hr_employee)

	- Cannot approve his own expenses

  * Simple user :
  	- Can only see his own expenses

	- Can only send his expenses to a manager (either the manager of
	  his department, his direct manager [parent_id field] or an
	  expense manager)

Related to task #51520
Closes #23033

2 files changed, 40 insertions, 4 deletions

diff --git a/addons/hr_expense/security/ir.model.access.csv b/addons/hr_expense/security/ir.model.access.csv
index b0e187d617f..f995ebe78d7 100644
--- a/addons/hr_expense/security/ir.model.access.csv
+++ b/addons/hr_expense/security/ir.model.access.csv
@@ -1,6 +1,7 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

 access_hr_expense_user,hr.expense.user,model_hr_expense,hr_expense.group_hr_expense_user,1,1,1,1

 access_hr_expense_employee,hr.expense.employee,model_hr_expense,base.group_user,1,1,1,1

+access_hr_expense_sheet_manager,hr.expense.sheet.manager,model_hr_expense_sheet,hr_expense.group_hr_expense_manager,1,1,1,1

 access_hr_expense_sheet_user,hr.expense.sheet.user,model_hr_expense_sheet,hr_expense.group_hr_expense_user,1,1,1,1

 access_hr_expense_sheet_employee,hr.expense.sheet.employee,model_hr_expense_sheet,base.group_user,1,1,1,1

 access_product_product_hr_expense_user,product.product.hr.expense.user,product.model_product_product,hr_expense.group_hr_expense_user,1,1,1,1

diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index eba7fe52e1a..5836c97b83a 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -2,21 +2,56 @@
 <odoo>
     <data noupdate="1">
 
-        <record id="property_rule_expense_manager" model="ir.rule">
+        <record id="ir_rule_hr_expense_manager" model="ir.rule">
             <field name="name">Manager Expense</field>
             <field name="model_id" ref="model_hr_expense"/>
             <field name="domain_force">[(1, '=', 1)]</field>
             <field name="groups" eval="[
                 (4, ref('account.group_account_user')),
-                (4, ref('hr_expense.group_hr_expense_manager')),
-                (4, ref('hr_expense.group_hr_expense_user'))]"/>
+                (4, ref('hr_expense.group_hr_expense_manager'))]"/>
         </record>
-        <record id="property_rule_expense_employee" model="ir.rule">
+        <record id="ir_rule_hr_expense_user" model="ir.rule">
+            <field name="name">Officer Expense</field>
+            <field name="model_id" ref="model_hr_expense"/>
+            <field name="domain_force">['|', '|', '|',
+                ('employee_id.user_id.id', '=', user.id),
+                ('employee_id.department_id.manager_id.user_id.id', '=', user.id),
+                ('employee_id.parent_id.user_id.id', '=', user.id),
+                ('employee_id.expense_manager_id.id', '=', user.id)]</field>
+            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
+        </record>
+        <record id="ir_rule_hr_expense_employee" model="ir.rule">
             <field name="name">Employee Expense</field>
             <field name="model_id" ref="model_hr_expense"/>
             <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
             <field name="groups" eval="[(4, ref('base.group_user'))]"/>
         </record>
+
+        <record id="ir_rule_hr_expense_sheet_manager" model="ir.rule">
+            <field name="name">Manager Expense Sheet</field>
+            <field name="model_id" ref="model_hr_expense_sheet"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+            <field name="groups" eval="[
+                (4, ref('account.group_account_user')),
+                (4, ref('hr_expense.group_hr_expense_manager'))]"/>
+        </record>
+        <record id="ir_rule_hr_expense_sheet_user" model="ir.rule">
+            <field name="name">Officer Expense Sheet</field>
+            <field name="model_id" ref="model_hr_expense_sheet"/>
+            <field name="domain_force">['|', '|', '|',
+                ('employee_id.user_id.id', '=', user.id),
+                ('employee_id.department_id.manager_id.user_id.id', '=', user.id),
+                ('employee_id.parent_id.user_id.id', '=', user.id),
+                ('employee_id.expense_manager_id.id', '=', user.id)]</field>
+            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
+        </record>
+        <record id="ir_rule_hr_expense_sheet_employee" model="ir.rule">
+            <field name="name">Employee Expense Sheet</field>
+            <field name="model_id" ref="model_hr_expense_sheet"/>
+            <field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+        </record>
+
         <record id="hr_expense_comp_rule" model="ir.rule">
             <field name="name">Expense multi company rule</field>
             <field name="model_id" ref="model_hr_expense"/>