[FIX] hr_attendance: Allow to checkin and checkout

Since 1594f82 a user can no longer checkin/checkout if not
in kiosk mode (warning "Wrong Pin").
The mentionned commit revealed a previous mistake: the pin was
never checked if `None` was provided because superuser does not have
group `hr_attendance.group_hr_attendance_use_pin`.

Pin checking should work as follows:
- For the logged in user: he should be able to checkin/checkout
without his pin through the "My attendances" action and with his pin
in kiosk mode
- For other employees: they should only be able to checkin/checkout with
their pin through kiosk mode.

The opportunity is taken to make method `attendance_action_change` private.

closes odoo/odoo#34058

Signed-off-by: Romain Libert (rli) <rli@odoo.com>

addons/hr_attendance/models/hr_employee.py

@@ -53,10 +53,10 @@ class HrEmployeeBase(models.AbstractModel):
     @api.multi
     def attendance_manual(self, next_action, entered_pin=None):
         self.ensure_one()
-        if not (entered_pin is None) or self.env.user.has_group('hr_attendance.group_hr_attendance_use_pin') and (self.user_id and self.user_id == self.env.user):
-            if entered_pin != self.pin:
-                return {'warning': _('Wrong PIN')}
-        return self._attendance_action(next_action)
+        can_check_without_pin = not self.env.user.has_group('hr_attendance.group_hr_attendance_use_pin') or (self.user_id == self.env.user and entered_pin is None)
+        if can_check_without_pin or entered_pin is not None and entered_pin == self.sudo().pin:
+            return self._attendance_action(next_action)
+        return {'warning': _('Wrong PIN')}
 
     @api.multi
     def _attendance_action(self, next_action):
@@ -73,14 +73,14 @@ class HrEmployeeBase(models.AbstractModel):
         action_message['next_action'] = next_action
 
         if employee.user_id:
-            modified_attendance = employee.sudo(employee.user_id.id).attendance_action_change()
+            modified_attendance = employee.sudo(employee.user_id.id)._attendance_action_change()
         else:
-            modified_attendance = employee.attendance_action_change()
+            modified_attendance = employee._attendance_action_change()
         action_message['attendance'] = modified_attendance.read()[0]
         return {'action': action_message}
 
     @api.multi
-    def attendance_action_change(self):
+    def _attendance_action_change(self):
         """ Check In/Check Out action
             Check In: create a new attendance record
             Check Out: modify check_out field of appropriate attendance record

addons/hr_attendance/tests/test_hr_attendance_process.py

@@ -1,5 +1,6 @@
 # -*- coding: utf-8 -*-
 
+from odoo.tests import new_test_user
 from odoo.tests.common import TransactionCase
 
 
@@ -8,12 +9,75 @@ class TestHrAttendance(TransactionCase):
 
     def setUp(self):
         super(TestHrAttendance, self).setUp()
-        self.test_employee = self.browse_ref('hr.employee_al')
+        self.user = new_test_user(self.env, login='fru', groups='base.group_user,hr_attendance.group_hr_attendance_use_pin')
+        self.user_no_pin = new_test_user(self.env, login='gru', groups='base.group_user')
+        self.test_employee = self.env['hr.employee'].create({
+            'name': "François Russie",
+            'user_id': self.user.id,
+            'pin': '1234',
+        })
+        self.employee_kiosk = self.env['hr.employee'].create({
+            'name': "Machiavel",
+            'pin': '5678',
+        })
 
     def test_employee_state(self):
         # Make sure the attendance of the employee will display correctly
         assert self.test_employee.attendance_state == 'checked_out'
-        self.test_employee.attendance_action_change()
+        self.test_employee._attendance_action_change()
         assert self.test_employee.attendance_state == 'checked_in'
-        self.test_employee.attendance_action_change()
+        self.test_employee._attendance_action_change()
         assert self.test_employee.attendance_state == 'checked_out'
+
+    def test_checkin_self_without_pin(self):
+        """ Employee can check in/out without pin with his own account """
+        employee = self.test_employee.sudo(self.user)
+        employee.sudo(self.user).attendance_manual({}, entered_pin=None)
+        self.assertEqual(employee.attendance_state, 'checked_in', "He should be able to check in without pin")
+        employee.attendance_manual({}, entered_pin=None)
+        self.assertEqual(employee.attendance_state, 'checked_out', "He should be able to check out without pin")
+
+    def test_checkin_self_with_pin(self):
+        """ Employee can check in/out with pin with his own account """
+        employee = self.test_employee.sudo(self.user)
+        employee.attendance_manual({}, entered_pin='1234')
+        self.assertEqual(employee.attendance_state, 'checked_in', "He should be able to check in with his pin")
+        employee.attendance_manual({}, entered_pin='1234')
+        self.assertEqual(employee.attendance_state, 'checked_out', "He should be able to check out with his pin")
+
+    def test_checkin_self_wrong_pin(self):
+        """ Employee cannot check in/out with wrong pin with his own account """
+        employee = self.test_employee.sudo(self.user)
+        action = employee.attendance_manual({}, entered_pin='9999')
+        self.assertNotEqual(employee.attendance_state, 'checked_in', "He should not be able to check in with a wrong pin")
+        self.assertTrue(action.get('warning'))
+
+    def test_checkin_kiosk_with_pin(self):
+        """ Employee can check in/out with his pin in kiosk """
+        employee = self.employee_kiosk.sudo(self.user)
+        employee.attendance_manual({}, entered_pin='5678')
+        self.assertEqual(employee.attendance_state, 'checked_in', "He should be able to check in with his pin")
+        employee.attendance_manual({}, entered_pin='5678')
+        self.assertEqual(employee.attendance_state, 'checked_out', "He should be able to check out with his pin")
+
+    def test_checkin_kiosk_with_wrong_pin(self):
+        """ Employee cannot check in/out with wrong pin in kiosk """
+        employee = self.employee_kiosk.sudo(self.user)
+        action = employee.attendance_manual({}, entered_pin='8888')
+        self.assertNotEqual(employee.attendance_state, 'checked_in', "He should not be able to check in with a wrong pin")
+        self.assertTrue(action.get('warning'))
+
+    def test_checkin_kiosk_without_pin(self):
+        """ Employee cannot check in/out without his pin in kiosk """
+        employee = self.employee_kiosk.sudo(self.user)
+        action = employee.attendance_manual({}, entered_pin=None)
+        self.assertNotEqual(employee.attendance_state, 'checked_in', "He should not be able to check in with no pin")
+        self.assertTrue(action.get('warning'))
+
+    def test_checkin_kiosk_no_pin_mode(self):
+        """ Employee can check in/out without pin in kiosk when user has not group `use_pin` """
+        employee = self.employee_kiosk.sudo(self.user_no_pin)
+        employee.attendance_manual({}, entered_pin=None)
+        self.assertEqual(employee.attendance_state, 'checked_in', "He should be able to check in with his pin")
+        employee.attendance_manual({}, entered_pin=None)
+        self.assertEqual(employee.attendance_state, 'checked_out', "He should be able to check out with his pin")