[IMP] project,project_issue,project_timesheet,project_issue_sheet: project visibility and access rights modifications

[REM] portal_project: move ALL the things
- move portal access rights from portal_project  and website_project_issue to project and project_issue
- move portal menuitems back to their respective module
- remove public visibility of projects
- adapt demo data to have a 'Demo Portal' project
- add correct access rights for account.analytic.line for portal users
- small view tweak (do not display 'timesheet' tab if one can't see antyhing in it anyway)

2 files changed, 42 insertions, 9 deletions

diff --git a/addons/project/security/ir.model.access.csv b/addons/project/security/ir.model.access.csv
index c4b1b896152..4800eb3f998 100644
--- a/addons/project/security/ir.model.access.csv
+++ b/addons/project/security/ir.model.access.csv
@@ -2,7 +2,8 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_project_project,project.project,model_project_project,project.group_project_user,1,0,0,0
 access_project_project_manager,project.project,model_project_project,project.group_project_manager,1,1,1,1
 access_account_analytic_account_user,account.analytic.account,analytic.model_account_analytic_account,project.group_project_user,1,0,0,0
-access_account_analytic_account,account.analytic.account,analytic.model_account_analytic_account,project.group_project_manager,1,1,1,1
+access_account_analytic_account_manager,account.analytic.account,analytic.model_account_analytic_account,project.group_project_manager,1,1,1,1
+access_account_analytic_account_portal,account_analytic_account,analytic.model_account_analytic_account,base.group_portal,1,0,0,0
 access_account_analytic_journal_project_manager,account.analytic.journal.project.manager,analytic.model_account_analytic_journal,project.group_project_manager,1,1,1,1
 access_account_analytic_journal_project_user,account.analytic.journal.project.user,analytic.model_account_analytic_journal,project.group_project_user,1,1,1,0
 access_project_task_type_user,project.task.type user,model_project_task_type,project.group_project_user,1,0,0,0
@@ -26,11 +27,7 @@ access_resource_calendar_leaves_user,resource.calendar.leaves user,resource.mode
 access_project_tags_all,project.project_tags_all,model_project_tags,,1,0,0,0
 access_project_tags_manager,project.project_tags_manager,model_project_tags,project.group_project_manager,1,1,1,1
 access_project_tags_portal,project_tags_portal,project.model_project_tags,base.group_portal,1,0,0,0
-access_project_tags_public,project_tags_public,project.model_project_tags,base.group_public,1,0,0,0
 access_mail_alias,mail.alias,mail.model_mail_alias,project.group_project_manager,1,1,1,1
 access_project_portal,project__portal,project.model_project_project,base.group_portal,1,0,0,0
 access_task_portal,task_portal,project.model_project_task,base.group_portal,1,0,0,0
 access_task_type_portal,task_type_portal,project.model_project_task_type,base.group_portal,1,0,0,0
-access_project_public,project_public,project.model_project_project,base.group_public,1,0,0,0
-access_task_public,task_public,project.model_project_task,base.group_public,1,0,0,0
-access_task_type_public,task_type_public,project.model_project_task_type,base.group_public,1,0,0,0
\ No newline at end of file
diff --git a/addons/project/security/project_security.xml b/addons/project/security/project_security.xml
index e1d8eb71b0a..b41208248ff 100644
--- a/addons/project/security/project_security.xml
+++ b/addons/project/security/project_security.xml
@@ -47,10 +47,10 @@
     </record>
 
     <record model="ir.rule" id="project_public_members_rule">
-        <field name="name">Project: employees: public, employees or followers</field>
+        <field name="name">Project: employees: portal, employees or followers</field>
         <field name="model_id" ref="model_project_project"/>
         <field name="domain_force">['|',
-                                        ('privacy_visibility', 'in', ['public', 'employees']),
+                                        ('privacy_visibility', 'in', ['portal', 'employees']),
                                         ('message_follower_ids', 'in', [user.partner_id.id])
                                     ]</field>
         <field name="groups" eval="[(4, ref('base.group_user'))]"/>
@@ -67,11 +67,11 @@
     </record>
 
     <record model="ir.rule" id="task_visibility_rule">
-        <field name="name">Project/Task: employees: public or employee or (followers and following)</field>
+        <field name="name">Project/Task: employees: portal or employee or (followers and following)</field>
         <field name="model_id" ref="model_project_task"/>
         <field name="domain_force">[
         '|',
-            ('project_id.privacy_visibility', 'in', ['public', 'employees']),
+            ('project_id.privacy_visibility', 'in', ['portal', 'employees']),
             '|',
                 '&amp;',
                     ('project_id.privacy_visibility', '=', 'followers'),
@@ -91,5 +91,41 @@
         <field name="groups" eval="[(4,ref('project.group_project_manager'))]"/>
     </record>
 
+    <!-- Portal -->
+    <record model="ir.rule" id="portal_project_rule">
+        <field name="name">Project: portal users: portal or following</field>
+        <field name="model_id" ref="project.model_project_project"/>
+        <field name="domain_force">[
+            '|',
+                '&amp;',
+                    ('privacy_visibility', '=', 'portal'),
+                    ('message_follower_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+                '&amp;',
+                    ('privacy_visibility', '=', 'followers'),
+                    ('message_follower_ids', 'in', [user.partner_id.id])
+        ]</field>
+        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
+    </record>
+
+    <record model="ir.rule" id="portal_task_rule">
+        <field name="name">Project/Task: portal users: (portal and colleagues following) or (followers and following)</field>
+        <field name="model_id" ref="project.model_project_task"/>
+        <field name="domain_force">[
+        '|',
+            '|',
+                '&amp;',
+                    ('project_id.privacy_visibility', '=', 'portal'),
+                    ('project_id.message_follower_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+                '&amp;',
+                    ('project_id.privacy_visibility', '=', 'followers'),
+                    ('project_id.message_follower_ids', 'in', [user.partner_id.id]),
+            '&amp;',
+                # on employee project can receive messages but not access the object
+                ('project_id.privacy_visibility', '!=', 'employees'),
+                ('message_follower_ids', 'in', [user.partner_id.id])
+        ]</field>
+        <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
+    </record>
+
 </data>
 </openerp>