From 2fb887225d2473ca386f3242cd2d85aca2ebf269 Mon Sep 17 00:00:00 2001
From: bbh-odoo <bbh@odoo.com>
Date: Wed, 21 Jul 2021 11:46:24 +0000
Subject: [PATCH] [IMP] hr_timesheet: improved  access rights

before this commit:
The approver can access all timesheets which is not coherent.

after this commit:
improved the labelling of the timesheet app's roles, modified the menu according
to role of User.Aprrover now can access his own timesheets only by click only
available option  'My timesheets'.

TaskID - 2531321

closes odoo/odoo#74242

Related: odoo/enterprise#19858
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
---
 addons/hr_timesheet/models/__init__.py             |  1 +
 addons/hr_timesheet/models/ir_ui_menu.py           | 14 ++++++++++++++
 .../security/hr_timesheet_security.xml             |  4 ++--
 addons/hr_timesheet/views/hr_timesheet_views.xml   |  8 ++++++++
 4 files changed, 25 insertions(+), 2 deletions(-)
 create mode 100644 addons/hr_timesheet/models/ir_ui_menu.py

diff --git a/addons/hr_timesheet/models/__init__.py b/addons/hr_timesheet/models/__init__.py
index 87061d8bb36..efa0ce7911a 100644
--- a/addons/hr_timesheet/models/__init__.py
+++ b/addons/hr_timesheet/models/__init__.py
@@ -4,6 +4,7 @@
 from . import hr_employee
 from . import hr_timesheet
 from . import ir_http
+from . import ir_ui_menu
 from . import res_company
 from . import res_config_settings
 from . import project
diff --git a/addons/hr_timesheet/models/ir_ui_menu.py b/addons/hr_timesheet/models/ir_ui_menu.py
new file mode 100644
index 00000000000..6eddc5e8085
--- /dev/null
+++ b/addons/hr_timesheet/models/ir_ui_menu.py
@@ -0,0 +1,14 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import models
+
+
+class IrUiMenu(models.Model):
+    _inherit = 'ir.ui.menu'
+
+    def _load_menus_blacklist(self):
+        res = super()._load_menus_blacklist()
+        if self.env.user.has_group('hr_timesheet.group_hr_timesheet_approver'):
+            res.append(self.env.ref('hr_timesheet.timesheet_menu_activity_user').id)
+        return res
diff --git a/addons/hr_timesheet/security/hr_timesheet_security.xml b/addons/hr_timesheet/security/hr_timesheet_security.xml
index 2c35c99bfb2..8cb5f7ad79b 100644
--- a/addons/hr_timesheet/security/hr_timesheet_security.xml
+++ b/addons/hr_timesheet/security/hr_timesheet_security.xml
@@ -7,14 +7,14 @@
         </record>
 
         <record id="group_hr_timesheet_user" model="res.groups">
-            <field name="name">See own timesheets</field>
+            <field name="name">User: own timesheets only</field>
             <field name="category_id" ref="base.module_category_services_timesheets"/>
             <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
             <field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
         </record>
 
         <record id="group_hr_timesheet_approver" model="res.groups">
-            <field name="name">Approver</field>
+            <field name="name">User: all timesheets</field>
             <field name="category_id" ref="base.module_category_services_timesheets"/>
             <field name="implied_ids" eval="[(4, ref('hr_timesheet.group_hr_timesheet_user'))]"/>
         </record>
diff --git a/addons/hr_timesheet/views/hr_timesheet_views.xml b/addons/hr_timesheet/views/hr_timesheet_views.xml
index 534a84c03ab..6695c0f7d47 100644
--- a/addons/hr_timesheet/views/hr_timesheet_views.xml
+++ b/addons/hr_timesheet/views/hr_timesheet_views.xml
@@ -12,6 +12,7 @@
         <menuitem id="menu_hr_time_tracking"
             name="Timesheets"
             parent="timesheet_menu_root"
+            groups = "group_hr_timesheet_approver"
             sequence="5"/>
 
         <!--
@@ -304,9 +305,16 @@
 
         <menuitem id="timesheet_menu_activity_mine"
             name="My Timesheets"
+            groups="group_hr_timesheet_approver"
             parent="menu_hr_time_tracking"
             action="act_hr_timesheet_line"/>
 
+        <menuitem id="timesheet_menu_activity_user"
+            name="My Timesheets"
+            groups="group_hr_timesheet_user"
+            parent="timesheet_menu_root"
+            action="act_hr_timesheet_line"/>
+
         <record id="timesheet_action_task" model="ir.actions.act_window">
             <field name="name">Task's Timesheets</field>
             <field name="res_model">account.analytic.line</field>