From 4c5edbd0fcd74eb3fedfe888663f2ac3409a4548 Mon Sep 17 00:00:00 2001
From: "Xavier BOL (xbo)" <xbo@odoo.com>
Date: Wed, 4 Aug 2021 08:59:50 +0200
Subject: [PATCH] [IMP] hr_timesheet: add read access to timesheets for portal
 users

Before this commit, the portal could not access to timesheets of the
task in project sharing views.

This commit adds the access to give him the read access to the
timesheets in the tasks of the shared project.
Moreover, this commit adds a `ir.rule` to limit the access to this
portal user and we keep the default values to True on all perms,
that way if someone modifies the ACL to give C/W/U permissions,
this rule will still give some protection.

task-2379518

closes #73341

Co-authored: Yannick Tivisse (yti) <yti@odoo.com>
---
 .../security/hr_timesheet_security.xml         | 18 ++++++++++++++++++
 .../hr_timesheet/security/ir.model.access.csv  |  1 +
 2 files changed, 19 insertions(+)

diff --git a/addons/hr_timesheet/security/hr_timesheet_security.xml b/addons/hr_timesheet/security/hr_timesheet_security.xml
index d4fd4902c46..2b20fc60087 100644
--- a/addons/hr_timesheet/security/hr_timesheet_security.xml
+++ b/addons/hr_timesheet/security/hr_timesheet_security.xml
@@ -30,6 +30,24 @@
             <field name="groups_id" eval="[(4,ref('group_timesheet_manager'))]"/>
         </record>
 
+        <record id="timesheet_line_rule_portal_user" model="ir.rule">
+            <field name="name">account.analytic.line.timesheet.portal.user</field>
+            <field name="model_id" ref="analytic.model_account_analytic_line"/>
+            <field name="domain_force">[
+                ('project_id', '!=', False),
+                '|',
+                    ('project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+                    ('task_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
+                ('project_id.privacy_visibility', '=', 'portal'),
+                ('project_id.project_sharing_access_ids.user_id', 'in', [user.id]),
+            ]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
+            <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
+        </record>
+
         <record id="timesheet_line_rule_user" model="ir.rule">
             <field name="name">account.analytic.line.timesheet.user</field>
             <field name="model_id" ref="analytic.model_account_analytic_line"/>
diff --git a/addons/hr_timesheet/security/ir.model.access.csv b/addons/hr_timesheet/security/ir.model.access.csv
index db5329a5262..ccddcb13a5d 100644
--- a/addons/hr_timesheet/security/ir.model.access.csv
+++ b/addons/hr_timesheet/security/ir.model.access.csv
@@ -1,4 +1,5 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_account_analytic_line_portal_user,analytic.account.analytic.line.timesheet.portal.user,analytic.model_account_analytic_line,base.group_portal,1,0,0,0
 access_account_analytic_line_user,analytic.account.analytic.line.timesheet.user,analytic.model_account_analytic_line,hr_timesheet.group_hr_timesheet_user,1,1,1,1
 access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.model_account_analytic_account,hr_timesheet.group_hr_timesheet_user,1,1,0,0
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0