From be15be7fa648fe0fbb93e3aadcec01d949ef83e2 Mon Sep 17 00:00:00 2001
From: jbm-odoo <jbm@odoo.com>
Date: Thu, 17 Oct 2019 13:14:43 +0000
Subject: [PATCH] [IMP] hr_attendance: Introduce Kiosk users group

It's the unique group needed for a kiosk attendance. Avoid to give
to much rigths.

id=2088561

closes odoo/odoo#38954

Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
---
 .../security/hr_attendance_security.xml       | 33 ++++++++++---------
 .../security/ir.model.access.csv              |  2 +-
 .../views/hr_attendance_view.xml              |  4 ++-
 3 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/addons/hr_attendance/security/hr_attendance_security.xml b/addons/hr_attendance/security/hr_attendance_security.xml
index ade106bb139..013b6069ac7 100644
--- a/addons/hr_attendance/security/hr_attendance_security.xml
+++ b/addons/hr_attendance/security/hr_attendance_security.xml
@@ -5,10 +5,27 @@
         <field name="sequence">14</field>
     </record>
 
+    <record id="group_hr_attendance_kiosk" model="res.groups">
+        <field name="name">Kiosk Attendance</field>
+        <field name="category_id" ref="base.module_category_human_resources_employees"/>
+        <field name="comment">The user will be able to open the kiosk mode and validate the employee PIN.</field>
+        <field name="implied_ids" eval="[(6, 0, [ref('base.group_user')])]"/>
+    </record>
+
+    <record id="hr.group_hr_user" model="res.groups">
+        <field name="implied_ids" eval="[(4, ref('hr_attendance.group_hr_attendance_kiosk'))]"/>
+    </record>
+
+    <record id="group_hr_attendance" model="res.groups">
+        <field name="name">Manual Attendance</field>
+        <field name="category_id" ref="base.module_category_human_resources_attendances"/>
+        <field name="comment">The user will gain access to the human resources attendance menu, enabling him to manage his own attendance.</field>
+    </record>
+
     <record id="group_hr_attendance_user" model="res.groups">
         <field name="name">Officer</field>
         <field name="category_id" ref="base.module_category_human_resources_attendances"/>
-        <field name="implied_ids" eval="[(4, ref('hr.group_hr_user'))]"/>
+        <field name="implied_ids" eval="[(4, ref('hr.group_hr_user')), (4, ref('hr_attendance.group_hr_attendance'))]"/>
     </record>
 
     <record id="group_hr_attendance_manager" model="res.groups">
@@ -18,24 +35,10 @@
         <field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
     </record>
 
-    <record id="group_hr_attendance" model="res.groups">
-        <field name="name">Manual Attendance</field>
-        <field name="category_id" ref="base.module_category_human_resources_attendances"/>
-        <field name="comment">The user will gain access to the human resources attendance menu, enabling him to manage his own attendance.</field>
-    </record>
-
     <record id="base.default_user" model="res.users">
         <field name="groups_id" eval="[(4,ref('hr_attendance.group_hr_attendance_manager'))]"/>
     </record>
 
-    <record id="hr_attendance.group_hr_attendance_manager" model="res.groups">
-        <field name="implied_ids" eval="[(4, ref('hr_attendance.group_hr_attendance'))]"/>
-    </record>
-
-    <record id="hr_attendance.group_hr_attendance_user" model="res.groups">
-        <field name="implied_ids" eval="[(4, ref('hr_attendance.group_hr_attendance'))]"/>
-    </record>
-
     <record id="group_hr_attendance_use_pin" model="res.groups">
         <field name="name">Enable PIN use</field>
         <field name="category_id" ref="base.module_category_hidden"/>
diff --git a/addons/hr_attendance/security/ir.model.access.csv b/addons/hr_attendance/security/ir.model.access.csv
index ca57b0fd50a..0c0cd4df5c8 100644
--- a/addons/hr_attendance/security/ir.model.access.csv
+++ b/addons/hr_attendance/security/ir.model.access.csv
@@ -1,3 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_hr_attendance_user,hr.attendance.user,model_hr_attendance,hr_attendance.group_hr_attendance_user,1,1,1,1
-access_hr_attendance_system_user,hr.attendance.system.user,model_hr_attendance,base.group_user,1,1,1,0
\ No newline at end of file
+access_hr_attendance_system_user,hr.attendance.system.user,model_hr_attendance,base.group_user,1,1,1,0
diff --git a/addons/hr_attendance/views/hr_attendance_view.xml b/addons/hr_attendance/views/hr_attendance_view.xml
index 5c9d2bd72f5..24390bcbe8e 100644
--- a/addons/hr_attendance/views/hr_attendance_view.xml
+++ b/addons/hr_attendance/views/hr_attendance_view.xml
@@ -174,7 +174,9 @@
 
     <!-- Menus -->
 
-    <menuitem id="menu_hr_attendance_root" name="Attendances" sequence="90" groups="hr_attendance.group_hr_attendance" web_icon="hr_attendance,static/description/icon.png"/>
+    <menuitem id="menu_hr_attendance_root" name="Attendances" sequence="90" groups="hr_attendance.group_hr_attendance,hr_attendance.group_hr_attendance_kiosk" web_icon="hr_attendance,static/description/icon.png"/>
+
+    <menuitem id="menu_hr_attendance_kiosk_no_user_mode" name="Kiosk Mode" parent="menu_hr_attendance_root" sequence="1" groups="hr_attendance.group_hr_attendance_kiosk" action="hr_attendance_action_kiosk_mode"/>
 
     <menuitem id="menu_hr_attendance_my_attendances" name="Check In / Check Out" parent="menu_hr_attendance_root" sequence="10" groups="hr_attendance.group_hr_attendance" action="hr_attendance_action_my_attendances"/>