[IMP] hr_timesheet: use access rights if user is internal

Before this commit, when the user can only see his own timesheets, this
user can see more than his own timesheets in timesheets portal
(/my/timesheets). It is because we use the domain defined for portal and
we don't use the access rights defined for this intenal user.

This commit uses the access right if the user has the lowest group for
Timesheet App. Otherwise, we use the domain for portal as before.

Co-authored-by: Laurent Stukkens (LTU) <ltu@odoo.com>

task-2424382

addons/hr_timesheet/controllers/portal.py

@@ -19,8 +19,9 @@ class TimesheetCustomerPortal(CustomerPortal):
     def _prepare_home_portal_values(self, counters):
         values = super()._prepare_home_portal_values(counters)
         if 'timesheet_count' in counters:
-            domain = request.env['account.analytic.line']._timesheet_get_portal_domain()
-            values['timesheet_count'] = request.env['account.analytic.line'].sudo().search_count(domain)
+            Timesheet = request.env['account.analytic.line']
+            domain = Timesheet._timesheet_get_portal_domain()
+            values['timesheet_count'] = Timesheet.sudo().search_count(domain)
         return values
 
     def _get_searchbar_inputs(self):
@@ -63,9 +64,11 @@ class TimesheetCustomerPortal(CustomerPortal):
 
     @http.route(['/my/timesheets', '/my/timesheets/page/<int:page>'], type='http', auth="user", website=True)
     def portal_my_timesheets(self, page=1, sortby=None, filterby=None, search=None, search_in='all', groupby='none', **kw):
-        Timesheet_sudo = request.env['account.analytic.line'].sudo()
+        Timesheet = request.env['account.analytic.line']
+        domain = Timesheet._timesheet_get_portal_domain()
+        Timesheet_sudo = Timesheet.sudo()
+
         values = self._prepare_portal_layout_values()
-        domain = request.env['account.analytic.line']._timesheet_get_portal_domain()
         _items_per_page = 100
 
         searchbar_sortings = {

addons/hr_timesheet/models/hr_timesheet.py

@@ -135,6 +135,9 @@ class AccountAnalyticLine(models.Model):
         return etree.tostring(doc, encoding='unicode')
 
     def _timesheet_get_portal_domain(self):
+        if self.env.user.has_group('hr_timesheet.group_hr_timesheet_user'):
+            # Then, he is internal user, and we take the domain for this current user
+            return self.env['ir.rule']._compute_domain(self._name)
         return ['&',
                     '|', '|', '|',
                     ('task_id.project_id.message_partner_ids', 'child_of', [self.env.user.partner_id.commercial_partner_id.id]),