From b6fc5ef468f47c109b2d007f211e02ca5f3fe093 Mon Sep 17 00:00:00 2001
From: Florent de Labarre <florent.mirieu@gmail.com>
Date: Wed, 10 Jun 2020 12:48:54 +0000
Subject: [PATCH] [FIX] hr_expense: Team Approver have acces to all accounting

1. Apply same logic for sale and purchase user.
2. The group Expense Team Approuver can write/create/unlink,
it is opposite than https://github.com/odoo/odoo/blob/13.0/addons/hr_expense/security/ir.model.access.csv#L15
and https://github.com/odoo/odoo/blob/13.0/addons/hr_expense/security/ir.model.access.csv#L16

opw:2275116

closes odoo/odoo#53405

Signed-off-by: Simon Goffin (sig) <sig@openerp.com>
---
 addons/hr_expense/security/ir.model.access.csv | 4 ++--
 addons/hr_expense/security/ir_rule.xml         | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/addons/hr_expense/security/ir.model.access.csv b/addons/hr_expense/security/ir.model.access.csv
index d768978e197..dfd8400da55 100644
--- a/addons/hr_expense/security/ir.model.access.csv
+++ b/addons/hr_expense/security/ir.model.access.csv
@@ -10,8 +10,8 @@ access_product_template_hr_expense_user,product.template.hr.expense.user,product
 access_uom_uom_hr_expense_user,uom.uom.hr.expense.user,uom.model_uom_uom,hr_expense.group_hr_expense_team_approver,1,1,1,1
 access_account_journal_user,account.journal.user,account.model_account_journal,hr_expense.group_hr_expense_team_approver,1,1,1,1
 access_account_journal_employee,account.journal.employee,account.model_account_journal,base.group_user,1,0,0,0
-access_account_move_user,account.move.hr.expense.approver,account.model_account_move,hr_expense.group_hr_expense_team_approver,1,1,1,1
-access_account_move_line_user,account.move.line.hr.expense.approver,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,1,1,1
+access_account_move_user,account.move.hr.expense.approver,account.model_account_move,hr_expense.group_hr_expense_team_approver,1,0,0,0
+access_account_move_line_user,account.move.line.hr.expense.approver,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,0,0,0
 access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_team_approver,1,1,1,1
 access_mail_activity_type_expense_user,mail.activity.type.expense.user,mail.model_mail_activity_type,hr_expense.group_hr_expense_manager,1,1,1,1
 access_hr_expense_refuse_wizard,access.hr.expense.refuse.wizard,model_hr_expense_refuse_wizard,hr_expense.group_hr_expense_team_approver,1,1,1,0
diff --git a/addons/hr_expense/security/ir_rule.xml b/addons/hr_expense/security/ir_rule.xml
index 947bcd66f76..b775a4544d5 100644
--- a/addons/hr_expense/security/ir_rule.xml
+++ b/addons/hr_expense/security/ir_rule.xml
@@ -64,4 +64,11 @@
             <field name="domain_force">['|',('company_id', '=', False), ('company_id', 'in', company_ids)]</field>
         </record>
 
+        <record id="hr_expense_team_approver_account_move_line_rule" model="ir.rule">
+            <field name="name">Expense Team Approver Account Move Line</field>
+            <field name="model_id" ref="account.model_account_move_line"/>
+            <field name="domain_force">[('expense_id', '!=', False)]</field>
+            <field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_team_approver'))]"/>
+        </record>
+
 </odoo>