[IMP] hr: Prevent non HR people from accessing employees bank accounts

- Billing officers / HR officers have access to all bank accounts
- Internal users only have access to bank accounts that are not linked to an employee
- Portal/Public users have access to nothing.

TaskID: 3101400

addons/account/security/account_security.xml

@@ -299,5 +299,17 @@
         <field name="model_id" ref="model_account_report_external_value"/>
         <field name="domain_force">[('company_id', 'in', company_ids)]</field>
     </record>
+
+    <!--
+        Allow billing officers from accessing res.partner.bank
+        This right is restricted in HR to prevent accessing
+        employees bank account for non HR people.
+    -->
+    <record id="ir_rule_res_partner_bank_billing_officers" model="ir.rule">
+        <field name="name">Billing: Allow accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
+    </record>
 </data>
 </odoo>

addons/hr/security/hr_security.xml

@@ -72,5 +72,19 @@
         <field name="model_id" ref="model_hr_plan_employee_activity"/>
         <field name="domain_force">['|', ('user_id', '=', user.id), ('activity_ids.user_id', '=', user.id)]</field>
     </record>
+
+    <record id="ir_rule_res_partner_bank_internal_users" model="ir.rule">
+        <field name="name">HR: Prevent non HR officers from accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[('partner_id.employee_ids', '=', False)]</field>
+        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="ir_rule_res_partner_bank_employees" model="ir.rule">
+        <field name="name">HR: Allow HR officers from accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('hr.group_hr_user'))]"/>
+    </record>
 </data>
 </odoo>