From 8390e282caefce1aec1ede6f9bf2543907eb55ce Mon Sep 17 00:00:00 2001
From: wan <wan@odoo.com>
Date: Thu, 19 Aug 2021 08:26:56 +0000
Subject: [PATCH] [IMP] account: add comments about security groups
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Had questions more than once about those.

closes odoo/odoo#75310

X-original-commit: ee7b8962269d02080d71a8419739b19693b3aa14
Signed-off-by: Florian Gilbert <FlorianGilbert@users.noreply.github.com>
Signed-off-by: William André (wan) <wan@odoo.com>
---
 addons/account/security/account_security.xml | 26 ++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index 5fe852d5d07..9f78a8f7d17 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -1,6 +1,32 @@
 <?xml version="1.0" encoding="utf-8"?>
 <odoo>
 <data noupdate="0">
+    <!--
+        There are 4 groups
+        The way the groups work is different when `account_accountant` is installed or not.
+
+        Invoicing only:
+        ```
+         group_account_invoice ⇨ group_account_manager   (only those two should be used)
+                               ⬂
+        group_account_readonly ⇨ group_account_user      (those two are only visible in debug)
+        ```
+
+        Invoicing + Accounting:
+        ```
+         group_account_invoice ⬂
+        group_account_readonly ⇨ group_account_user ⇨ group_account_manager
+        ```
+        `group_account_user` is almost (a bit more than) the sum of `group_account_invoice` and `group_account_readonly`
+        `group_account_manager` is the king (except when Consolidation is installed, then there is a super-king)
+
+        `group_account_invoice` can create/edit invoices, refunds, payments, etc but cannot see accounting related stuff (journal entries, reports, reconciliation,...)
+        `group_account_readonly` can see (and only see) everything, including the journal entries, advanced configuration, reports
+        `group_account_user`  is the accountant: he can do everything except advanced config (accounting periods for instance)
+        `group_account_manager` can edit some config that `group_account_user` cannot do
+
+        When you have only Invoicing installed, only `group_account_invoice` and `group_account_manager` should be used. The others are giving a shallow access to Accounting features, but we want to remove that.
+    -->
 
     <record model="ir.module.category" id="base.module_category_accounting_accounting">
         <field name="description">Helps you handle your accounting needs, if you are not an accountant, we suggest you to install only the Invoicing.</field>