[FIX] hr_timesheet, sale_timesheet: Fix project user cannot access

Project app

If a user has Project/User group but does not have any Timesheets group
or Analytic Accounting group, he cannot access the Project app (a
security error message appears).

The problem is some of 'project.project' model's fields is computing
based on 'account.analytic.line' model, which the Project/User group
does not have the right to read it.

This PR adds corresponding groups to these computed fields, or changing
the computing method to make sure there is no error if project user
reads on the 'project.project' model.

closes odoo/odoo#87393

X-original-commit: 9df63eb25bfe65bce43a557b8635d967fa5a8d6a
Signed-off-by: Xavier <xbo@odoo.com>
Signed-off-by: Laurent Stukkens (ltu) <ltu@odoo.com>

addons/hr_timesheet/models/project.py

@@ -38,10 +38,10 @@ class Project(models.Model):
     )
 
     timesheet_ids = fields.One2many('account.analytic.line', 'project_id', 'Associated Timesheets')
-    timesheet_count = fields.Integer(compute="_compute_timesheet_count")
+    timesheet_count = fields.Integer(compute="_compute_timesheet_count", groups='hr_timesheet.group_hr_timesheet_user')
     timesheet_encode_uom_id = fields.Many2one('uom.uom', related='company_id.timesheet_encode_uom_id')
     total_timesheet_time = fields.Integer(
-        compute='_compute_total_timesheet_time',
+        compute='_compute_total_timesheet_time', groups='hr_timesheet.group_hr_timesheet_user',
         help="Total number of time (in the proper UoM) recorded in the project, rounded to the unit.")
     encode_uom_in_days = fields.Boolean(compute='_compute_encode_uom_in_days')
     is_internal_project = fields.Boolean(compute='_compute_is_internal_project', search='_search_is_internal_project')

addons/hr_timesheet/views/project_views.xml

@@ -297,7 +297,7 @@
                     <field name="allocated_hours" invisible="1"/>
                 </field>
                 <xpath expr="//div[hasclass('o_kanban_manage_view')]" position="inside">
-                    <div role="menuitem" t-if="record.allow_timesheets.raw_value and record.timesheet_count.raw_value" groups="hr_timesheet.group_hr_timesheet_user">
+                    <div role="menuitem" t-if="record.allow_timesheets.raw_value and record.timesheet_count and record.timesheet_count.raw_value" groups="hr_timesheet.group_hr_timesheet_user">
                         <a name="%(act_hr_timesheet_line_by_project)d" type="action">Timesheets</a>
                     </div>
                 </xpath>

addons/sale_timesheet/models/project.py

@@ -38,7 +38,7 @@ class Project(models.Model):
         help="Employee/Sale Order Item Mapping:\n Defines to which sales order item an employee's timesheet entry will be linked."
         "By extension, it defines the rate at which an employee's time on the project is billed.")
     billable_percentage = fields.Integer(
-        compute='_compute_billable_percentage',
+        compute='_compute_billable_percentage', groups='hr_timesheet.group_hr_timesheet_approver',
         help="% of timesheets that are billable compared to the total number of timesheets linked to the AA of the project, rounded to the unit.")
     display_create_order = fields.Boolean(compute='_compute_display_create_order')
     timesheet_product_id = fields.Many2one(
@@ -51,7 +51,7 @@ class Project(models.Model):
         help='Select a Service product with which you would like to bill your time spent on tasks.',
         compute="_compute_timesheet_product_id", store=True, readonly=False,
         default=_default_timesheet_product_id)
-    warning_employee_rate = fields.Boolean(compute='_compute_warning_employee_rate')
+    warning_employee_rate = fields.Boolean(compute='_compute_warning_employee_rate', compute_sudo=True)
     partner_id = fields.Many2one(
         compute='_compute_partner_id', store=True, readonly=False)
     allocated_hours = fields.Float(compute='_compute_allocated_hours', store=True, readonly=False, copy=False)