From dc19707baa167c58c845be3dbf1b169b7faeff7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lucas=20Lef=C3=A8vre?= <lul@odoo.com>
Date: Mon, 4 Mar 2019 10:10:34 +0100
Subject: [PATCH] [FIX] l10n_be_hr_payroll_fleet: Fix access rights issues

If a user is member of `hr_contract.group_hr_contract_manager`
but not member of `fleet.fleet_group_manager` some access issues arise
The issues are related to the `car_id` field of `hr.contract`
because the user has no access rights for `fleet.vehicle`.

Fix to solve the issue:
Make all car related field of contracts available
to fleet manager only.

If the contract manager want to be able to manage cars on
contracts, he must manually be granted fleet manager access.
This is a requirement if the contract manager want to use the
company car feature.
---
 .../models/hr_contract.py                      | 18 ++++++++++--------
 .../views/hr_contract_views.xml                |  8 +++-----
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/addons/l10n_be_hr_payroll_fleet/models/hr_contract.py b/addons/l10n_be_hr_payroll_fleet/models/hr_contract.py
index a680b2f1cfe..7ab5f9ed103 100644
--- a/addons/l10n_be_hr_payroll_fleet/models/hr_contract.py
+++ b/addons/l10n_be_hr_payroll_fleet/models/hr_contract.py
@@ -8,8 +8,9 @@ class HrContract(models.Model):
     _inherit = 'hr.contract'
 
     car_id = fields.Many2one('fleet.vehicle', string='Company Car',
-        default=lambda self: self.env['fleet.vehicle'].search([('driver_id', '=', self.employee_id.address_home_id.id)], limit=1),
+        default=lambda self: self.env['fleet.vehicle'].sudo().search([('driver_id', '=', self.employee_id.address_home_id.id)], limit=1),
         tracking=True,
+        groups="fleet.fleet_group_manager",
         help="Employee's company car.")
     car_atn = fields.Float(compute='_compute_car_atn_and_costs', string='ATN Company Car', store=True, compute_sudo=True)
     company_car_total_depreciated_cost = fields.Float(compute='_compute_car_atn_and_costs', store=True, compute_sudo=True)
@@ -18,13 +19,14 @@ class HrContract(models.Model):
     # YTI: Check if could be removed
     new_car_model_id = fields.Many2one('fleet.vehicle.model', string="Model", domain=lambda self: self._get_possible_model_domain())
     max_unused_cars = fields.Integer(compute='_compute_max_unused_cars')
-    acquisition_date = fields.Date(related='car_id.acquisition_date', readonly=False)
-    car_value = fields.Float(related="car_id.car_value", readonly=False)
-    fuel_type = fields.Selection(related="car_id.fuel_type", readonly=False)
-    co2 = fields.Float(related="car_id.co2", readonly=False)
-    driver_id = fields.Many2one('res.partner', related="car_id.driver_id", readonly=False)
-    car_open_contracts_count = fields.Integer(compute='_compute_car_open_contracts_count')
+    acquisition_date = fields.Date(related='car_id.acquisition_date', readonly=False, groups="fleet.fleet_group_manager")
+    car_value = fields.Float(related="car_id.car_value", readonly=False, groups="fleet.fleet_group_manager")
+    fuel_type = fields.Selection(related="car_id.fuel_type", readonly=False, groups="fleet.fleet_group_manager")
+    co2 = fields.Float(related="car_id.co2", readonly=False, groups="fleet.fleet_group_manager")
+    driver_id = fields.Many2one('res.partner', related="car_id.driver_id", readonly=False, groups="fleet.fleet_group_manager")
+    car_open_contracts_count = fields.Integer(compute='_compute_car_open_contracts_count', groups="fleet.fleet_group_manager")
     recurring_cost_amount_depreciated = fields.Float(
+        groups="fleet.fleet_group_manager",
         compute='_compute_recurring_cost_amount_depreciated',
         inverse="_inverse_recurring_cost_amount_depreciated")
 
@@ -65,7 +67,7 @@ class HrContract(models.Model):
     @api.depends('name')
     def _compute_available_cars_amount(self):
         for contract in self:
-            contract.available_cars_amount = self.env['fleet.vehicle'].search_count([('driver_id', '=', False)])
+            contract.available_cars_amount = self.env['fleet.vehicle'].sudo().search_count([('driver_id', '=', False)])
 
     @api.depends('name')
     def _compute_max_unused_cars(self):
diff --git a/addons/l10n_be_hr_payroll_fleet/views/hr_contract_views.xml b/addons/l10n_be_hr_payroll_fleet/views/hr_contract_views.xml
index 45b6b9a526b..9f3443de241 100644
--- a/addons/l10n_be_hr_payroll_fleet/views/hr_contract_views.xml
+++ b/addons/l10n_be_hr_payroll_fleet/views/hr_contract_views.xml
@@ -6,20 +6,18 @@
         <field name="inherit_id" ref="l10n_be_hr_payroll.hr_contract_view_form"/>
         <field name="arch" type="xml">
             <xpath expr="//field[@name='transport_mode_car']" position="after">
-                <field name="new_car" invisible="1"/>
-                <label for="car_id" attrs="{'invisible': [('transport_mode_car', '=', False)]}" name="car_id_label"/>
-                <div attrs="{'invisible': [('transport_mode_car', '=', False)]}" name="car_id_div">
+                <label for="car_id" string="Company Car" attrs="{'invisible': [('transport_mode_car', '=', False)]}" name="car_id_label" groups="fleet.fleet_group_manager"/>
+                <div attrs="{'invisible': [('transport_mode_car', '=', False)]}" name="car_id_div" groups="fleet.fleet_group_manager">
                     <field name="car_id" nolabel="1"/>
                     <field name="available_cars_amount" invisible="1"/>
                 </div>
-                <field name="new_car_model_id" invisible="1"/>
                 <field name="max_unused_cars" invisible="1"/>
             </xpath>
             <xpath expr="//field[@name='car_atn']" position="after">
                 <field name="company_car_total_depreciated_cost" invisible="1"/>
             </xpath>
             <group name="yearly_advantages" position="after">
-                <group string="Company Car" attrs="{'invisible': [('car_id', '=', False)]}">
+                <group string="Company Car" attrs="{'invisible': [('car_id', '=', False)]}" groups="fleet.fleet_group_manager">
                     <field name="acquisition_date"/>
                     <field name="car_value"/>
                     <field name="fuel_type"/>