From 84e8aa90dd030f9848ae29254e270af700bf528f Mon Sep 17 00:00:00 2001
From: Yannick Tivisse <yti@odoo.com>
Date: Wed, 5 Jul 2023 12:50:15 +0200
Subject: [PATCH] [IMP] hr: Prevent non HR people from accessing employees bank
 accounts

- Billing officers / HR officers have access to all bank accounts
- Internal users only have access to bank accounts that are not linked to an employee
- Portal/Public users have access to nothing.

TaskID: 3101400
---
 addons/account/security/account_security.xml | 12 ++++++++++++
 addons/hr/security/hr_security.xml           | 14 ++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index 0ea90c4dbe6..8e08ed1693e 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -299,5 +299,17 @@
         <field name="model_id" ref="model_account_report_external_value"/>
         <field name="domain_force">[('company_id', 'in', company_ids)]</field>
     </record>
+
+    <!--
+        Allow billing officers from accessing res.partner.bank
+        This right is restricted in HR to prevent accessing
+        employees bank account for non HR people.
+    -->
+    <record id="ir_rule_res_partner_bank_billing_officers" model="ir.rule">
+        <field name="name">Billing: Allow accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
+    </record>
 </data>
 </odoo>
diff --git a/addons/hr/security/hr_security.xml b/addons/hr/security/hr_security.xml
index 717928e00db..f9fccadd833 100644
--- a/addons/hr/security/hr_security.xml
+++ b/addons/hr/security/hr_security.xml
@@ -72,5 +72,19 @@
         <field name="model_id" ref="model_hr_plan_employee_activity"/>
         <field name="domain_force">['|', ('user_id', '=', user.id), ('activity_ids.user_id', '=', user.id)]</field>
     </record>
+
+    <record id="ir_rule_res_partner_bank_internal_users" model="ir.rule">
+        <field name="name">HR: Prevent non HR officers from accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[('partner_id.employee_ids', '=', False)]</field>
+        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="ir_rule_res_partner_bank_employees" model="ir.rule">
+        <field name="name">HR: Allow HR officers from accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('hr.group_hr_user'))]"/>
+    </record>
 </data>
 </odoo>