[IMP] project,hr_timesheet: enable project sharing feature when needed

Before this commit, the project sharing feature is enabled by default
when the Project app is installed but the user could never use the
feature and thus we add more access rights to portal user for nothing.

To avoid this, this commit removes by default all additional access
rights given by project sharing feature and adds this access rights only
when a collaborator is added.
If the user removes all collaborators for all projects then we need
to disable the feature. That is, we will remove the access rights and
ir.rule records added.
So, the feature will not really disable but we remove the additionnal
access rights and ir.rule records added with this feature.

task-2379518

closes #73341

addons/hr_timesheet/__init__.py

@@ -8,6 +8,8 @@ from . import wizard
 
 from odoo import api, fields, SUPERUSER_ID, _
 
+from odoo.addons.project import _check_exists_collaborators_for_project_sharing
+
 
 def create_internal_project(cr, registry):
     env = api.Environment(cr, SUPERUSER_ID, {})
@@ -28,3 +30,5 @@ def create_internal_project(cr, registry):
         'project_id': task.project_id.id,
         'task_id': task.id,
     } for task in project_ids.task_ids.filtered(lambda t: t.company_id in admin.employee_ids.company_id)])
+
+    _check_exists_collaborators_for_project_sharing(env)

addons/hr_timesheet/__manifest__.py

@@ -24,6 +24,7 @@ up a management by affair.
     'data': [
         'security/hr_timesheet_security.xml',
         'security/ir.model.access.csv',
+        'security/ir.model.access.xml',
         'data/digest_data.xml',
         'views/hr_timesheet_views.xml',
         'views/res_config_settings_views.xml',

addons/hr_timesheet/models/__init__.py

@@ -7,5 +7,6 @@ from . import ir_http
 from . import res_company
 from . import res_config_settings
 from . import project
+from . import project_collaborator
 from . import project_update
 from . import uom

addons/hr_timesheet/models/project_collaborator.py

@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import api, models
+
+
+class ProjectCollaborator(models.Model):
+    _inherit = 'project.collaborator'
+
+    @api.model
+    def _toggle_project_sharing_portal_rules(self, active):
+        super()._toggle_project_sharing_portal_rules(active)
+        # ir.model.access
+        access_timesheet_portal = self.env.ref('hr_timesheet.access_account_analytic_line_portal_user').sudo()
+        if access_timesheet_portal.active != active:
+            access_timesheet_portal.write({'active': active})
+
+        # ir.rule
+        timesheet_portal_ir_rule = self.env.ref('hr_timesheet.timesheet_line_rule_portal_user').sudo()
+        if timesheet_portal_ir_rule.active != active:
+            access_timesheet_portal.write({'active': active})

addons/hr_timesheet/security/hr_timesheet_security.xml

@@ -33,6 +33,7 @@
         <record id="timesheet_line_rule_portal_user" model="ir.rule">
             <field name="name">account.analytic.line.timesheet.portal.user</field>
             <field name="model_id" ref="analytic.model_account_analytic_line"/>
+            <field name="active">0</field>
             <field name="domain_force">[
                 ('project_id', '!=', False),
                 '|',

addons/hr_timesheet/security/ir.model.access.csv

@@ -1,5 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-access_account_analytic_line_portal_user,analytic.account.analytic.line.timesheet.portal.user,analytic.model_account_analytic_line,base.group_portal,1,0,0,0
 access_account_analytic_line_user,analytic.account.analytic.line.timesheet.user,analytic.model_account_analytic_line,hr_timesheet.group_hr_timesheet_user,1,1,1,1
 access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.model_account_analytic_account,hr_timesheet.group_hr_timesheet_user,1,1,0,0
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0

addons/hr_timesheet/security/ir.model.access.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <data noupdate="1">
+
+        <record id="access_account_analytic_line_portal_user" model="ir.model.access">
+            <field name="name">analytic.account.analytic.line.timesheet.portal.user</field>
+            <field name="model_id" ref="analytic.model_account_analytic_line"/>
+            <field name="group_id" ref="base.group_portal"/>
+            <field name="active">0</field>
+            <field name="perm_read">1</field>
+            <field name="perm_write">0</field>
+            <field name="perm_create">0</field>
+            <field name="perm_unlink">0</field>
+        </record>
+
+    </data>
+
+</odoo>

addons/project/__init__.py

@@ -6,3 +6,21 @@ from . import models
 from . import report
 from . import wizard
 from . import populate
+
+from odoo import api, SUPERUSER_ID
+
+
+def _check_exists_collaborators_for_project_sharing(env):
+    """ Check if it exists at least a collaborator in a shared project
+
+        If it is the case we need to active the portal rules added only for this feature.
+    """
+    collaborator = env['project.collaborator'].search([], limit=1)
+    if collaborator:
+        # Then we need to enable the access rights linked to project sharing for the portal user
+        env['project.collaborator']._toggle_project_sharing_portal_rules(True)
+
+
+def _project_post_init(cr, registry):
+    env = api.Environment(cr, SUPERUSER_ID, {})
+    _check_exists_collaborators_for_project_sharing(env)

addons/project/__manifest__.py

@@ -23,6 +23,7 @@
     'data': [
         'security/project_security.xml',
         'security/ir.model.access.csv',
+        'security/ir.model.access.xml',
         'data/digest_data.xml',
         'report/project_report_views.xml',
         'report/project_task_burndown_chart_report_views.xml',
@@ -55,6 +56,7 @@
     'installable': True,
     'auto_install': False,
     'application': True,
+    'post_init_hook': '_project_post_init',
     'assets': {
         'web.assets_backend': [
             'project/static/src/css/project.css',

addons/project/models/project_collaborator.py

@@ -17,7 +17,37 @@ class ProjectCollaborator(models.Model):
 
     @api.model_create_multi
     def create(self, vals_list):
+        collaborator = self.env['project.collaborator'].search([], limit=1)
         project_collaborators = super().create(vals_list)
         non_authenticated_collaborator = project_collaborators.partner_id.filtered(lambda partner: not partner.user_ids)
         non_authenticated_collaborator._create_portal_users()
+        if not collaborator:
+            self._toggle_project_sharing_portal_rules(True)
         return project_collaborators
+
+    def unlink(self):
+        res = super().unlink()
+        # Check if it remains at least a collaborator in all shared projects.
+        collaborator = self.env['project.collaborator'].search([], limit=1)
+        if not collaborator:  # then disable the project sharing feature
+            self._toggle_project_sharing_portal_rules(False)
+        return res
+
+    @api.model
+    def _toggle_project_sharing_portal_rules(self, active):
+        """ Enable/disable project sharing feature
+
+            When the first collaborator is added in the model then we need to enable the feature.
+            In the inverse case, if no collaborator is stored in the model then we disable the feature.
+            To enable/disable the feature, we just need to enable/disable the ir.model.access and ir.rule
+            added to portal user that we do not want to give when we know the project sharing is unused.
+
+            :param active: contains boolean value, True to enable the project sharing feature, otherwise we disable the feature.
+        """
+        access_project_sharing_portal = self.env.ref('project.access_project_sharing_task_portal').sudo()
+        if access_project_sharing_portal.active != active:
+            access_project_sharing_portal.write({'active': active})
+
+        task_portal_ir_rule = self.env.ref('project.project_task_rule_portal_project_sharing').sudo()
+        if task_portal_ir_rule.active != active:
+            task_portal_ir_rule.write({'active': active})

addons/project/security/ir.model.access.csv

@@ -11,7 +11,7 @@ access_project_task,project.task,model_project_task,project.group_project_user,1
 access_report_project_task_user,report.project.task.user,model_report_project_task_user,project.group_project_manager,1,1,1,1
 access_partner_task_user,base.res.partner user,base.model_res_partner,project.group_project_user,1,0,0,0
 access_task_on_partner,project.task on partners,model_project_task,base.group_user,1,0,0,0
-access_task_portal,task_portal,project.model_project_task,base.group_portal,1,1,1,0
+access_task_portal,task_portal,project.model_project_task,base.group_portal,1,0,0,0
 access_project_user,project.project on partners,model_project_project,base.group_user,1,0,0,0
 access_project_portal,project_portal,project.model_project_project,base.group_portal,1,0,0,0
 access_resource_calendar,project.resource_calendar user,resource.model_resource_calendar,project.group_project_user,1,0,0,0

addons/project/security/ir.model.access.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <data noupdate="1">
+
+        <record id="access_project_sharing_task_portal" model="ir.model.access">
+            <field name="name">project_sharing_task_portal</field>
+            <field name="model_id" ref="model_project_task"/>
+            <field name="group_id" ref="base.group_portal"/>
+            <field name="active">0</field>
+            <field name="perm_read">0</field>
+            <field name="perm_write">1</field>
+            <field name="perm_create">1</field>
+            <field name="perm_unlink">0</field>
+        </record>
+
+    </data>
+
+</odoo>

addons/project/security/project_security.xml

@@ -149,6 +149,7 @@
     <record id="project_task_rule_portal_project_sharing" model="ir.rule">
         <field name="name">Project/Task: portal users: portal user can edit with project sharing feature</field>
         <field name="model_id" ref="project.model_project_task"/>
+        <field name="active">0</field>
         <field name="domain_force">[
             ('project_id.privacy_visibility', '=', 'portal'),
             ('active', '=', True),