[IMP] hr_expense : improve access rights of manager/officer

Currently the distinction between expense officers and expense managers
doesn't make sense because they both have the same rights.

This commit aims at making a clear difference between an officer and a
manager.

After this commit the rights will look like this :

  * Expense Manager :
  	- See and approve any expense

  * Expense Officer :
  	- Can see and approve the expenses of employees in his department
	  or employees for which he is the manager (field parent_id on
	  hr_employee)

	- Cannot approve his own expenses

  * Simple user :
  	- Can only see his own expenses

	- Can only send his expenses to a manager (either the manager of
	  his department, his direct manager [parent_id field] or an
	  expense manager)

Related to task #51520
Closes #23033

2 files changed, 161 insertions, 0 deletions

diff --git a/addons/hr_expense/tests/common.py b/addons/hr_expense/tests/common.py
index 71a4d33e757..0ff8e27fba0 100644
--- a/addons/hr_expense/tests/common.py
+++ b/addons/hr_expense/tests/common.py
@@ -21,6 +21,7 @@ class TestExpenseCommon(TestAccountNoChartCommon):
         # create employee
         cls.employee = cls.env['hr.employee'].create({
             'name': 'Johnny Employee',
+            'user_id': cls.user_employee.id,
             'address_home_id': cls.user_employee.partner_id.id,
             'address_id': cls.user_employee.partner_id.id,
         })
@@ -56,3 +57,66 @@ class TestExpenseCommon(TestAccountNoChartCommon):
             'employee_id': cls.employee.id,
             'journal_id': cls.journal.id,
         })
+
+        Users = cls.env['res.users'].with_context(no_reset_password=True)
+
+        # Find Employee group
+        group_employee_id = cls.env.ref('base.group_user').id
+
+        cls.user_emp2 = Users.create({
+            'name': 'Superboy Employee',
+            'login': 'superboy',
+            'email': 'superboy@example.com',
+            'groups_id': [(6, 0, [group_employee_id])]
+        })
+
+        cls.user_officer = Users.create({
+            'name': 'Batman Officer',
+            'login': 'batman',
+            'email': 'batman.hero@example.com',
+            'groups_id': [(6, 0, [group_employee_id, cls.env.ref('hr_expense.group_hr_expense_user').id])]
+        })
+
+        cls.emp_emp2 = cls.env['hr.employee'].create({
+            'name': 'Superboy',
+            'user_id': cls.user_emp2.id,
+        })
+
+        cls.emp_officer = cls.env['hr.employee'].create({
+            'name': 'Batman',
+            'user_id': cls.user_officer.id,
+        })
+
+        cls.emp_manager = cls.env['hr.employee'].create({
+            'name': 'Superman',
+            'user_id': cls.user_manager.id,
+        })
+
+        cls.rd = cls.env['hr.department'].create({
+            'name': 'R&D',
+            'manager_id': cls.emp_officer.id,
+            'member_ids': [(6, 0, [cls.employee.id])],
+        })
+
+        cls.ps = cls.env['hr.department'].create({
+            'name': 'PS',
+            'manager_id': cls.emp_manager.id,
+            'member_ids': [(6, 0, [cls.emp_emp2.id])],
+        })
+
+        cls.uom_unit = cls.env.ref('uom.product_uom_unit').id
+        cls.uom_dozen = cls.env.ref('uom.product_uom_dozen').id
+
+        cls.product_1 = cls.env['product.product'].create({
+            'name': 'Batmobile repair',
+            'type': 'service',
+            'uom_id': cls.uom_unit,
+            'uom_po_id': cls.uom_unit,
+        })
+
+        cls.product_2 = cls.env['product.product'].create({
+            'name': 'Superboy costume washing',
+            'type': 'service',
+            'uom_id': cls.uom_unit,
+            'uom_po_id': cls.uom_unit,
+        })
diff --git a/addons/hr_expense/tests/test_expenses.py b/addons/hr_expense/tests/test_expenses.py
index 976ba9188ae..8d526b02a36 100644
--- a/addons/hr_expense/tests/test_expenses.py
+++ b/addons/hr_expense/tests/test_expenses.py
@@ -1,6 +1,8 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from odoo.exceptions import UserError, AccessError
+
 from odoo.addons.hr_expense.tests.common import TestExpenseCommon
 
 
@@ -72,3 +74,98 @@ class TestAccountEntry(TestExpenseCommon):
         self.assertEquals(len(self.analytic_account.line_ids), 1, "Analytic Account should have only one line")
         self.assertAlmostEquals(self.analytic_account.line_ids[0].amount, -636.36, "Amount on the only AAL is wrong")
         self.assertEquals(self.analytic_account.line_ids[0].product_id, self.product_expense, "Product of AAL should be the one from the expense")
+
+
+class TestExpenseRights(TestExpenseCommon):
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestExpenseRights, cls).setUpClass()
+
+    def test_expense_create(self):
+        # Employee should be able to create an Expense
+        self.env['hr.expense'].sudo(self.user_employee.id).create({
+            'name': 'Batmobile repair',
+            'employee_id': self.employee.id,
+            'product_id': self.product_1.id,
+            'unit_amount': 1,
+            'quantity': 1,
+        })
+
+        # Employee should not be able to create an Expense for someone else
+        with self.assertRaises(AccessError):
+            self.env['hr.expense'].sudo(self.user_employee.id).create({
+                'name': 'Superboy costume washing',
+                'employee_id': self.emp_emp2.id,
+                'product_id': self.product_2.id,
+                'unit_amount': 1,
+                'quantity': 1,
+            })
+
+    def test_expense_approve(self):
+        sheet = self.env['hr.expense.sheet'].create({
+            'name': 'Furnitures',
+            'employee_id': self.emp_officer.id,
+        })
+
+        sheet_2 = self.env['hr.expense.sheet'].create({
+            'name': 'Services',
+            'employee_id': self.employee.id,
+        })
+
+        sheet_3 = self.env['hr.expense.sheet'].create({
+            'name': 'Services 2',
+            'employee_id': self.emp_emp2.id,
+        })
+
+        # Employee should not be able to approve expense sheet
+        with self.assertRaises(UserError):
+            sheet.sudo(self.user_officer).approve_expense_sheets()
+        # Officer should not be able to approve own expense sheet
+        with self.assertRaises(UserError):
+            sheet.sudo(self.user_officer).approve_expense_sheets()
+        sheet.sudo(self.user_manager).approve_expense_sheets()
+
+        # Officer should be able to approve expense from his department
+        sheet_2.sudo(self.user_officer).approve_expense_sheets()
+
+        # Officer should not be able to approve expense sheet from another department
+        with self.assertRaises(AccessError):
+            sheet_3.sudo(self.user_officer).approve_expense_sheets()
+        sheet_3.sudo(self.user_manager).approve_expense_sheets()
+
+    def test_expense_refuse(self):
+        sheet = self.env['hr.expense.sheet'].create({
+            'name': 'Furnitures',
+            'employee_id': self.emp_officer.id,
+        })
+
+        sheet_2 = self.env['hr.expense.sheet'].create({
+            'name': 'Services',
+            'employee_id': self.employee.id,
+        })
+
+        sheet_3 = self.env['hr.expense.sheet'].create({
+            'name': 'Services 2',
+            'employee_id': self.emp_emp2.id,
+        })
+
+        sheet.sudo(self.user_manager).approve_expense_sheets()
+        sheet_2.sudo(self.user_manager).approve_expense_sheets()
+        sheet_3.sudo(self.user_manager).approve_expense_sheets()
+
+        # Employee should not be able to refuse expense sheet
+        with self.assertRaises(UserError):
+            sheet.sudo(self.user_employee).refuse_sheet('')
+        # Officer should not be able to refuse own expense sheet
+        with self.assertRaises(UserError):
+            sheet.sudo(self.user_officer).refuse_sheet('')
+        sheet.sudo(self.user_manager).refuse_sheet('')
+
+        # Officer should be able to refuse expense from his department
+        sheet_2.sudo(self.user_officer).refuse_sheet('')
+
+        # Officer should not be able to refuse expense sheet from another department
+        with self.assertRaises(AccessError):
+            sheet_3.sudo(self.user_officer).refuse_sheet('')
+        sheet_3.sudo(self.user_manager).refuse_sheet('')