From 2a45fbe3d27b78f48af4a2f70343141b4e0c0a0b Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Fri, 28 Jul 2017 16:02:24 +0200
Subject: [PATCH] [IMP] account: Isolate `group_account_user` in account

Purpose
=======

We want to clear the accounting access groups when only the Invoicing application is installed as follows:

If only Invoicing is installed, we should only have 2 groups: `Billing` and `Billing Manager`
If Accouting and Finance is installed, we should have the current groups: `Billing`, `Accountant` and `Advisor`

Specification
=============

1/ If we have only Invoicing the should have the following hierarchy:

group_account_manager (Billing Manager) ---Implies---> group_account_invoice (Billing)

group_account_user (Accountant) is a technical group out the Accouting groups hierarchy

2/ If we have Accouting and Finance installed, we should then have:

group_account_manager (Advisor) ---Implies---> group_account_user (Accountant) ---Implies---> group_account_invoice (Billing)

The reason we want to keep the group_account_user is that we will hide the accouting fields (account_id,...) with this group, allowing the consultants to show the accouting related information on support.
---
 addons/account/security/account_security.xml     | 16 +++++++---------
 .../security/account_accountant_security.xml     | 14 +++++++++++++-
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index f51d87d63a8..6bb043e94fd 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -8,21 +8,19 @@
         <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
     </record>
 
-    <!-- 2 steps to avoid making reference to xml id not defined yet -->
-    <record id="group_account_invoice" model="res.groups">
-        <field name="users" eval="[(4, ref('base.user_root'))]"/>
+    <record id="group_account_user" model="res.groups">
+        <field name="name">Show Full Accounting Features</field>
+        <field name="category_id" ref="base.module_category_hidden"/>
     </record>
 
-    <record id="group_account_user" model="res.groups">
-        <field name="name">Accountant</field>
+    <record id="group_account_manager" model="res.groups">
+        <field name="name">Billing Manager</field>
         <field name="category_id" ref="base.module_category_accounting_and_finance"/>
         <field name="implied_ids" eval="[(4, ref('group_account_invoice'))]"/>
     </record>
 
-    <record id="group_account_manager" model="res.groups">
-        <field name="name">Adviser</field>
-        <field name="category_id" ref="base.module_category_accounting_and_finance"/>
-        <field name="implied_ids" eval="[(4, ref('group_account_user'))]"/>
+    <record id="base.user_root" model="res.users">
+        <field name="groups_id" eval="[(4, ref('account.group_account_invoice')), (4, ref('account.group_account_manager'))]"/>
     </record>
 
     <record id="group_warning_account" model="res.groups">
diff --git a/addons/account_accountant/security/account_accountant_security.xml b/addons/account_accountant/security/account_accountant_security.xml
index 1340e7abc94..d86c828209b 100644
--- a/addons/account_accountant/security/account_accountant_security.xml
+++ b/addons/account_accountant/security/account_accountant_security.xml
@@ -1,6 +1,18 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
         <record id="base.user_root" model="res.users">
-            <field name="groups_id" eval="[(4, ref('account.group_account_manager')),(4, ref('account.group_account_user'))]"/>
+            <field name="groups_id" eval="[(4, ref('account.group_account_user'))]"/>
         </record>
+
+        <record id="account.group_account_user" model="res.groups">
+            <field name="name">Accountant</field>
+            <field name="implied_ids" eval="[(4, ref('account.group_account_invoice'))]"/>
+            <field name="category_id" ref="base.module_category_accounting_and_finance"/>
+        </record>
+
+        <record id="account.group_account_manager" model="res.groups">
+            <field name="name">Advisor</field>
+            <field name="implied_ids" eval="[(3, ref('account.group_account_invoice')), (4, ref('account.group_account_user'))]"/>
+        </record>
+
 </odoo>