Files
odoo_source/addons/hr_expense/security/ir_rule.xml
T
RomainLibert 5c24368e33 [IMP] hr_expense : improve access rights of manager/officer
Currently the distinction between expense officers and expense managers
doesn't make sense because they both have the same rights.

This commit aims at making a clear difference between an officer and a
manager.

After this commit the rights will look like this :

  * Expense Manager :
  	- See and approve any expense

  * Expense Officer :
  	- Can see and approve the expenses of employees in his department
	  or employees for which he is the manager (field parent_id on
	  hr_employee)

	- Cannot approve his own expenses

  * Simple user :
  	- Can only see his own expenses

	- Can only send his expenses to a manager (either the manager of
	  his department, his direct manager [parent_id field] or an
	  expense manager)

Related to task #51520
Closes #23033
2018-05-25 11:52:17 +02:00

70 lines
3.7 KiB
XML

<?xml version="1.0" encoding="utf-8"?>
<odoo>
<data noupdate="1">
<record id="ir_rule_hr_expense_manager" model="ir.rule">
<field name="name">Manager Expense</field>
<field name="model_id" ref="model_hr_expense"/>
<field name="domain_force">[(1, '=', 1)]</field>
<field name="groups" eval="[
(4, ref('account.group_account_user')),
(4, ref('hr_expense.group_hr_expense_manager'))]"/>
</record>
<record id="ir_rule_hr_expense_user" model="ir.rule">
<field name="name">Officer Expense</field>
<field name="model_id" ref="model_hr_expense"/>
<field name="domain_force">['|', '|', '|',
('employee_id.user_id.id', '=', user.id),
('employee_id.department_id.manager_id.user_id.id', '=', user.id),
('employee_id.parent_id.user_id.id', '=', user.id),
('employee_id.expense_manager_id.id', '=', user.id)]</field>
<field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
</record>
<record id="ir_rule_hr_expense_employee" model="ir.rule">
<field name="name">Employee Expense</field>
<field name="model_id" ref="model_hr_expense"/>
<field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
<field name="groups" eval="[(4, ref('base.group_user'))]"/>
</record>
<record id="ir_rule_hr_expense_sheet_manager" model="ir.rule">
<field name="name">Manager Expense Sheet</field>
<field name="model_id" ref="model_hr_expense_sheet"/>
<field name="domain_force">[(1, '=', 1)]</field>
<field name="groups" eval="[
(4, ref('account.group_account_user')),
(4, ref('hr_expense.group_hr_expense_manager'))]"/>
</record>
<record id="ir_rule_hr_expense_sheet_user" model="ir.rule">
<field name="name">Officer Expense Sheet</field>
<field name="model_id" ref="model_hr_expense_sheet"/>
<field name="domain_force">['|', '|', '|',
('employee_id.user_id.id', '=', user.id),
('employee_id.department_id.manager_id.user_id.id', '=', user.id),
('employee_id.parent_id.user_id.id', '=', user.id),
('employee_id.expense_manager_id.id', '=', user.id)]</field>
<field name="groups" eval="[(4, ref('hr_expense.group_hr_expense_user'))]"/>
</record>
<record id="ir_rule_hr_expense_sheet_employee" model="ir.rule">
<field name="name">Employee Expense Sheet</field>
<field name="model_id" ref="model_hr_expense_sheet"/>
<field name="domain_force">[('employee_id.user_id', '=', user.id)]</field>
<field name="groups" eval="[(4, ref('base.group_user'))]"/>
</record>
<record id="hr_expense_comp_rule" model="ir.rule">
<field name="name">Expense multi company rule</field>
<field name="model_id" ref="model_hr_expense"/>
<field eval="True" name="global"/>
<field name="domain_force">['|',('company_id', '=', False), ('company_id', 'child_of', [user.company_id.id])]</field>
</record>
<record id="hr_expense_report_comp_rule" model="ir.rule">
<field name="name">Expense Report multi company rule</field>
<field name="model_id" ref="model_hr_expense_sheet"/>
<field eval="True" name="global"/>
<field name="domain_force">['|',('company_id', '=', False), ('company_id', 'child_of', [user.company_id.id])]</field>
</record>
</data>
</odoo>