[IMP] hr_timesheet: Improve access rights

TaskID: 2088586

The low level access right is now "See my timesheets".
This access disallow to a user to view and manage the timesheets of others users.

When the visibility of a project is set on "Invited employees",
the users with the access rules : 'See my timesheet' and
'See all timesheets' can show the timesheets, if these users
follow the project.

2 files changed, 33 insertions, 8 deletions

diff --git a/addons/hr_timesheet/security/hr_timesheet_security.xml b/addons/hr_timesheet/security/hr_timesheet_security.xml
index 64033b482ec..ca969ce739d 100644
--- a/addons/hr_timesheet/security/hr_timesheet_security.xml
+++ b/addons/hr_timesheet/security/hr_timesheet_security.xml
@@ -7,14 +7,14 @@
         </record>
 
         <record id="group_hr_timesheet_user" model="res.groups">
-            <field name="name">See all Timesheets</field>
+            <field name="name">See own timesheets</field>
             <field name="category_id" ref="base.module_category_operations_timesheets"/>
             <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
             <field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
         </record>
 
         <record id="base.default_user" model="res.users">
-            <field name="groups_id" eval="[(4,ref('group_hr_timesheet_user'))]"/>
+            <field name="groups_id" eval="[(4,ref('group_timesheet_manager'))]"/>
         </record>
     </data>
 
@@ -23,16 +23,24 @@
         <record id="timesheet_line_rule_user" model="ir.rule">
             <field name="name">account.analytic.line.timesheet.user</field>
             <field name="model_id" ref="analytic.model_account_analytic_line"/>
-            <field name="domain_force">[('user_id', '=', user.id), ('project_id', '!=', False)]</field>
+            <field name="domain_force">[
+                ('user_id', '=', user.id),
+                ('project_id', '!=', False),
+                '|',
+                    ('project_id.privacy_visibility', '!=', 'followers'),
+                    '|',
+                        ('project_id.message_partner_ids', 'in', [user.partner_id.id]),
+                        ('task_id.message_partner_ids', 'in', [user.partner_id.id])
+            ]</field>
             <field name="groups" eval="[(4, ref('group_hr_timesheet_user'))]"/>
             <field name="perm_create" eval="1"/>
             <field name="perm_write" eval="1"/>
             <field name="perm_unlink" eval="1"/>
-            <field name="perm_read" eval="0"/>
+            <field name="perm_read" eval="1"/>
         </record>
 
-        <record id="hr_timesheet.group_hr_timesheet_approver" model="res.groups">
-            <field name="name">Team Approver</field>
+        <record id="group_hr_timesheet_approver" model="res.groups">
+            <field name="name">See all timesheets</field>
             <field name="category_id" ref="base.module_category_operations_timesheets"/>
             <field name="implied_ids" eval="[(4, ref('hr_timesheet.group_hr_timesheet_user'))]"/>
         </record>
@@ -40,7 +48,7 @@
         <record id="group_timesheet_manager" model="res.groups">
             <field name="name">Administrator</field>
             <field name="category_id" ref="base.module_category_operations_timesheets"/>
-            <field name="implied_ids" eval="[(4, ref('group_hr_timesheet_approver')), (4, ref('hr.group_hr_user'))]"/>
+            <field name="implied_ids" eval="[(4, ref('hr_timesheet.group_hr_timesheet_approver')), (4, ref('hr.group_hr_user'))]"/>
             <field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
         </record>
     </data>
@@ -60,4 +68,19 @@
 
     </data>
 
+    <record id="timesheet_line_rule_approver" model="ir.rule">
+        <field name="name">account.analytic.line.timesheet.approver</field>
+        <field name="model_id" ref="analytic.model_account_analytic_line" />
+        <field name="domain_force">[
+            ('project_id', '!=', False),
+            '|',
+                ('project_id.privacy_visibility', '!=', 'followers'),
+                ('project_id.message_partner_ids', 'in', [user.partner_id.id])
+        ]</field>
+        <field name="groups" eval="[(4, ref('hr_timesheet.group_hr_timesheet_approver'))]" />
+        <field name="perm_create" eval="1"/>
+        <field name="perm_write" eval="1"/>
+        <field name="perm_unlink" eval="1"/>
+        <field name="perm_read" eval="1"/>
+    </record>
 </odoo>
diff --git a/addons/hr_timesheet/security/ir.model.access.csv b/addons/hr_timesheet/security/ir.model.access.csv
index cb11fb119f7..84cb43d62e1 100644
--- a/addons/hr_timesheet/security/ir.model.access.csv
+++ b/addons/hr_timesheet/security/ir.model.access.csv
@@ -1,5 +1,7 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

-access_account_analytic_line_user,analytic.account.analytic.line.timesheet.user,analytic.model_account_analytic_line,hr_timesheet.group_hr_timesheet_user,1,1,1,1

+access_account_analytic_line_manager,analytic.account.analytic.line.timesheet.manager,analytic.model_account_analytic_line,hr_timesheet.group_timesheet_manager,1,1,1,1

+access_account_analytic_line_approver,analytic.account.analytic.line.timesheet.approver,analytic.model_account_analytic_line,hr_timesheet.group_hr_timesheet_approver,1,1,1,1

+access_account_analytic_line_user,analytic.account.analytic.line.timesheet.user,analytic.model_account_analytic_line,hr_timesheet.group_hr_timesheet_user,1,1,1,1,1

 access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.model_account_analytic_account,hr_timesheet.group_hr_timesheet_user,1,1,0,0

 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0

 access_project_project,project.project.timesheet.user,model_project_project,hr_timesheet.group_hr_timesheet_user,1,0,0,0