[IMP] base,*: Reorganize access rights groups

Purpose
=======

Access group terminology is missleading. Yous have to be manager to administrate
an application. This task consists to rename groups to be understandable for everyone.

Groups should be reorganised on the users form to be more explicit.

Specification
=============

1/ Rename 'Manager' to 'Administrator' in users groups.
2/ Define a hierarchy on access groups by using the category_id in the manifests
   A category 'Operations/Project' will create a category Project with a parent
   category 'Operations', and something smart is already developed (in modules/db.py)
   to avoid duplicating categories.
3/ Add a group in expenses to be able to approve expenses reports for my team.
4/ Add a group in timesheets to be able to approve timesheets for my team.
5/ Remove partially the useless crap in ir_module_category_data.xml
6/ Sort access rights groups on users form according to its parent category

closes odoo/odoo#29362

Signed-off-by: "Yannick Tivisse (yti)" <yti@odoo.com>

3 files changed, 45 insertions, 35 deletions

diff --git a/addons/hr_expense/security/hr_expense_security.xml b/addons/hr_expense/security/hr_expense_security.xml
index 31809dbf201..a36c60a048f 100644
--- a/addons/hr_expense/security/hr_expense_security.xml
+++ b/addons/hr_expense/security/hr_expense_security.xml
@@ -1,14 +1,25 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
-    <record id="group_hr_expense_user" model="res.groups">
-        <field name="name">Officer</field>
-        <field name="category_id" ref="base.module_category_hr_expense"/>
+    <record model="ir.module.category" id="base.module_category_accounting_expenses">
+        <field name="description">Helps you manage your expenses.</field>
+        <field name="sequence">12</field>
+    </record>
+
+    <record id="group_hr_expense_team_approver" model="res.groups">
+        <field name="name">Team Approver</field>
+        <field name="category_id" ref="base.module_category_accounting_expenses"/>
         <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
     </record>
 
+    <record id="group_hr_expense_user" model="res.groups">
+        <field name="name">All Approver</field>
+        <field name="category_id" ref="base.module_category_accounting_expenses"/>
+        <field name="implied_ids" eval="[(4, ref('hr_expense.group_hr_expense_team_approver'))]"/>
+    </record>
+
     <record id="group_hr_expense_manager" model="res.groups">
-        <field name="name">Manager</field>
-        <field name="category_id" ref="base.module_category_hr_expense"/>
+        <field name="name">Administrator</field>
+        <field name="category_id" ref="base.module_category_accounting_expenses"/>
         <field name="implied_ids" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
         <field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
     </record>
@@ -16,4 +27,4 @@
     <record id="base.default_user" model="res.users">
         <field name="groups_id" eval="[(4,ref('hr_expense.group_hr_expense_manager'))]"/>
     </record>
-</odoo>
\ No newline at end of file
+</odoo>
diff --git a/addons/hr_expense/security/ir.model.access.csv b/addons/hr_expense/security/ir.model.access.csv
index f2d58d25114..238dd2e4845 100644
--- a/addons/hr_expense/security/ir.model.access.csv
+++ b/addons/hr_expense/security/ir.model.access.csv
@@ -1,19 +1,19 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

 access_hr_expense_employee,hr.expense.employee,model_hr_expense,base.group_user,1,1,1,1

 access_hr_expense_sheet_employee,hr.expense.sheet.employee,model_hr_expense_sheet,base.group_user,1,1,1,1

-access_hr_expense_user,hr.expense.user,model_hr_expense,hr_expense.group_hr_expense_user,1,1,1,1

-access_hr_expense_sheet_user,hr.expense.sheet.user,model_hr_expense_sheet,hr_expense.group_hr_expense_user,1,1,1,1

+access_hr_expense_user,hr.expense.user,model_hr_expense,hr_expense.group_hr_expense_team_approver,1,1,1,1

+access_hr_expense_sheet_user,hr.expense.sheet.user,model_hr_expense_sheet,hr_expense.group_hr_expense_team_approver,1,1,1,1

 access_hr_expense_manager,hr.expense.manager,model_hr_expense,hr_expense.group_hr_expense_manager,1,1,1,1

 access_hr_expense_sheet_manager,hr.expense.sheet.manager,model_hr_expense_sheet,hr_expense.group_hr_expense_manager,1,1,1,1

-access_product_product_hr_expense_user,product.product.hr.expense.user,product.model_product_product,hr_expense.group_hr_expense_user,1,1,1,1

-access_product_template_hr_expense_user,product.template.hr.expense.user,product.model_product_template,hr_expense.group_hr_expense_user,1,1,1,1

-access_uom_uom_hr_expense_user,uom.uom.hr.expense.user,uom.model_uom_uom,hr_expense.group_hr_expense_user,1,1,1,1

-access_account_journal_user,account.journal.user,account.model_account_journal,hr_expense.group_hr_expense_user,1,1,1,1

+access_product_product_hr_expense_user,product.product.hr.expense.user,product.model_product_product,hr_expense.group_hr_expense_team_approver,1,1,1,1

+access_product_template_hr_expense_user,product.template.hr.expense.user,product.model_product_template,hr_expense.group_hr_expense_team_approver,1,1,1,1

+access_uom_uom_hr_expense_user,uom.uom.hr.expense.user,uom.model_uom_uom,hr_expense.group_hr_expense_team_approver,1,1,1,1

+access_account_journal_user,account.journal.user,account.model_account_journal,hr_expense.group_hr_expense_team_approver,1,1,1,1

 access_account_journal_employee,account.journal.employee,account.model_account_journal,base.group_user,1,0,0,0

-access_account_invoice_user,account.invoice.user,account.model_account_invoice,hr_expense.group_hr_expense_user,1,1,1,1

-access_account_invoice_line_user,account.invoice.line.user,account.model_account_invoice_line,hr_expense.group_hr_expense_user,1,1,1,1

-access_account_invoice_tax_user,account.invoice.tax.user,account.model_account_invoice_tax,hr_expense.group_hr_expense_user,1,0,0,0

-access_account_move_user,account.move.user,account.model_account_move,hr_expense.group_hr_expense_user,1,0,0,0

-access_account_move_line_user,account.move.line.user,account.model_account_move_line,hr_expense.group_hr_expense_user,1,0,0,0

-access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_user,1,1,1,1

+access_account_invoice_user,account.invoice.user,account.model_account_invoice,hr_expense.group_hr_expense_team_approver,1,1,1,1

+access_account_invoice_line_user,account.invoice.line.user,account.model_account_invoice_line,hr_expense.group_hr_expense_team_approver,1,1,1,1

+access_account_invoice_tax_user,account.invoice.tax.user,account.model_account_invoice_tax,hr_expense.group_hr_expense_team_approver,1,0,0,0

+access_account_move_user,account.move.user,account.model_account_move,hr_expense.group_hr_expense_team_approver,1,0,0,0

+access_account_move_line_user,account.move.line.user,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,0,0,0

+access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_team_approver,1,1,1,1

 access_mail_activity_type_expense_user,mail.activity.type.expense.user,mail.model_mail_activity_type,hr_expense.group_hr_expense_manager,1,1,1,1

diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index 5836c97b83a..51a3a8d641d 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -1,24 +1,23 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
     <data noupdate="1">
-
         <record id="ir_rule_hr_expense_manager" model="ir.rule">
             <field name="name">Manager Expense</field>
             <field name="model_id" ref="model_hr_expense"/>
             <field name="domain_force">[(1, '=', 1)]</field>
             <field name="groups" eval="[
                 (4, ref('account.group_account_user')),
-                (4, ref('hr_expense.group_hr_expense_manager'))]"/>
+                (4, ref('hr_expense.group_hr_expense_user'))]"/>
         </record>
-        <record id="ir_rule_hr_expense_user" model="ir.rule">
-            <field name="name">Officer Expense</field>
+        <record id="ir_rule_hr_expense_approver" model="ir.rule">
+            <field name="name">Team Approver Expense</field>
             <field name="model_id" ref="model_hr_expense"/>
             <field name="domain_force">['|', '|', '|',
-                ('employee_id.user_id.id', '=', user.id),
-                ('employee_id.department_id.manager_id.user_id.id', '=', user.id),
-                ('employee_id.parent_id.user_id.id', '=', user.id),
-                ('employee_id.expense_manager_id.id', '=', user.id)]</field>
-            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
+                ('employee_id.user_id', '=', user.id),
+                ('employee_id.department_id.manager_id.user_id', '=', user.id),
+                ('employee_id.parent_id.user_id', '=', user.id),
+                ('employee_id.expense_manager_id', '=', user.id)]</field>
+            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_team_approver'))]"/>
         </record>
         <record id="ir_rule_hr_expense_employee" model="ir.rule">
             <field name="name">Employee Expense</field>
@@ -33,17 +32,17 @@
             <field name="domain_force">[(1, '=', 1)]</field>
             <field name="groups" eval="[
                 (4, ref('account.group_account_user')),
-                (4, ref('hr_expense.group_hr_expense_manager'))]"/>
+                (4, ref('hr_expense.group_hr_expense_user'))]"/>
         </record>
-        <record id="ir_rule_hr_expense_sheet_user" model="ir.rule">
-            <field name="name">Officer Expense Sheet</field>
+        <record id="ir_rule_hr_expense_sheet_approver" model="ir.rule">
+            <field name="name">Approver Expense Sheet</field>
             <field name="model_id" ref="model_hr_expense_sheet"/>
             <field name="domain_force">['|', '|', '|',
-                ('employee_id.user_id.id', '=', user.id),
-                ('employee_id.department_id.manager_id.user_id.id', '=', user.id),
-                ('employee_id.parent_id.user_id.id', '=', user.id),
-                ('employee_id.expense_manager_id.id', '=', user.id)]</field>
-            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
+                ('employee_id.user_id', '=', user.id),
+                ('employee_id.department_id.manager_id.user_id', '=', user.id),
+                ('employee_id.parent_id.user_id', '=', user.id),
+                ('employee_id.expense_manager_id', '=', user.id)]</field>
+            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_team_approver'))]"/>
         </record>
         <record id="ir_rule_hr_expense_sheet_employee" model="ir.rule">
             <field name="name">Employee Expense Sheet</field>