odoo18/addons_extensions/project_task_timesheet_extended/security/security.xml

<?xml version="1.0" encoding="UTF-8" ?>
<odoo>
    <record id="group_project_supervisor" model="res.groups">
        <field name="name">Manager</field>
        <field name="category_id" ref="base.module_category_services_project"/>
        <field name="implied_ids" eval="[(4, ref('project.group_project_user'))]"/>
    </record>

    <record id="group_project_lead" model="res.groups">
        <field name="name">Project Lead</field>
        <field name="category_id" ref="base.module_category_services_project"/>
    </record>


    <record id="project.group_project_manager" model="res.groups">
        <field name="implied_ids" eval="[(4, ref('project.group_project_user')),(4, ref('group_project_supervisor')), (4, ref('mail.group_mail_canned_response_admin'))]"/>
    </record>

    <data>
        <function name="write" model="ir.model.data">
            <function name="search" model="ir.model.data">
                <value eval="[('module', '=', 'project'), ('name', '=', 'project_public_members_rule')]"/>
            </function>
            <value eval="{'noupdate': False}"/>
        </function>

        <record id="project.project_public_members_rule" model="ir.rule">
            <field name="domain_force">['|',
                            ('privacy_visibility', '!=', 'followers'),
                            ('message_ids', 'in', [user.id])
                        ]</field>
        </record>

        <function name="write" model="ir.model.data">
            <function name="search" model="ir.model.data">
                <value eval="[('module', '=', 'project'), ('name', '=', 'project_public_members_rule')]"/>
            </function>
            <value eval="{'noupdate': True}"/>
        </function>


        <function name="write" model="ir.model.data">
            <function name="search" model="ir.model.data">
                <value eval="[('module', '=', 'project'), ('name', '=', 'project_project_manager_rule')]"/>
            </function>
            <value eval="{'noupdate': False}"/>
        </function>

        <record id="project.project_project_manager_rule" model="ir.rule">
            <field name="domain_force">[(1, '=', 1)]</field>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_unlink" eval="1"/>
        </record>

        <function name="write" model="ir.model.data">
            <function name="search" model="ir.model.data">
                <value eval="[('module', '=', 'project'), ('name', '=', 'project_project_manager_rule')]"/>
            </function>
            <value eval="{'noupdate': True}"/>
        </function>
        <record id="portfolio_rule_company_projects" model="ir.rule">
            <field name="name">company: Own Company</field>
            <field name="model_id" ref="model_project_portfolio"/>
            <field name="domain_force">[('company_id', 'in', company_ids + [False])]</field>
        </record>

        <record id="project_rule_manager_own_projects" model="ir.rule">
            <field name="name">Manager: Own Projects</field>
            <field name="model_id" ref="project.model_project_project"/>
            <field name="groups" eval="[(4, ref('project_task_timesheet_extended.group_project_supervisor'))]"/>
            <field name="domain_force">['|', ('user_id', '=', user.id), ('user_id', '=', False)]</field>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="0"/>
            <field name="perm_unlink" eval="0"/>
        </record>

        <record model="ir.rule" id="project_supervisor_all_project_tasks_rule">
            <field name="name">Project/Task: project supervisor: see all tasks linked to his assigned project or its own tasks</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[
                ('project_id.user_id','=',user.id),
                '|', ('project_id', '!=', False),
                     ('user_ids', 'in', user.id),
            ]</field>
            <field name="groups" eval="[(4,ref('project_task_timesheet_extended.group_project_supervisor'))]"/>
        </record>

        <record model="ir.rule" id="project_users_project_tasks_rule">
            <field name="name">Project/Task: project users: don't see non generic tasks</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[
                '&amp;', '&amp;', '&amp;',
                ('project_id', '!=', False),
                ('is_generic', '=', False),
                ('user_ids', 'not in', user.id),
                ('involved_user_ids', 'not in', user.id),
                ]
            </field>
            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user'))]"/>
            <field name="perm_read" eval="0"/>
        </record>

        <record model="ir.rule" id="project_users_project_lead_rule">
            <field name="name">Project/Task: project lead: see all tasks</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[
                '&amp;', '&amp;', '&amp;',
                ('project_id', '!=', False),
                ('project_id.project_lead', '=', user.id),
                '|', ('is_generic', '=', True), ('is_generic', '=', False),
                '|', ('user_ids', 'in', user.id), ('user_ids', 'not in', user.id)
                ]
            </field>
            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user'))]"/>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="0"/>
            <field name="perm_unlink" eval="0"/>
        </record>



        <function name="write" model="ir.model.data">
            <function name="search" model="ir.model.data">
                <value eval="[('module', '=', 'project'), ('name', '=', 'project_manager_all_project_tasks_rule')]"/>
            </function>
            <value eval="{'noupdate': False}"/>
        </function>

        <record id="project.project_manager_all_project_tasks_rule" model="ir.rule">
            <field name="domain_force">[(1, '=', 1)]</field>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_unlink" eval="1"/>
        </record>

        <function name="write" model="ir.model.data">
            <function name="search" model="ir.model.data">
                <value eval="[('module', '=', 'project'), ('name', '=', 'project_manager_all_project_tasks_rule')]"/>
            </function>
            <value eval="{'noupdate': True}"/>
        </function>
        <record model="ir.rule" id="project.ir_rule_private_task">
            <field name="domain_force">[
                '&amp;',
                    ('project_id', '!=', False),
                    ('project_id.privacy_visibility', '!=', 'followers'),
                '|',
                    '&amp;',
                        ('is_generic', '=', True),
                        '|', '|',
                            ('project_id', '!=', False),
                            ('parent_id', '!=', False),
                            ('user_ids', 'in', user.id),
                    '&amp;',
                        ('is_generic', '=', False),
                        '|',
                            ('user_ids', 'in', user.id),
                            ('involved_user_ids', 'in', user.id),
            ]</field>
        </record>

        <record model="ir.rule" id="project.task_visibility_rule">
            <field name="domain_force">[
                '|',
                    '&amp;',
                        ('project_id', '!=', False),
                        '|', '|',
                            ('is_generic', '=', True),
                            ('user_ids', 'in', user.id),
                            ('involved_user_ids', 'in', user.id),
                    '&amp;',
                        ('project_id', '=', False),
                        '|',
                            ('message_partner_ids', 'in', [user.partner_id.id]),
                            ('user_ids', 'in', user.id),
            ]</field>
        </record>
        <record model="ir.rule" id="project.task_visibility_rule_project_user">
            <field name="domain_force">[
                '|',
                    '&amp;',
                        ('project_id', '!=', False),
                        '|', '|',
                            ('is_generic', '=', True),
                            ('user_ids', 'in', user.id),
                            ('involved_user_ids', 'in', user.id),
                    '&amp;',
                        ('project_id', '=', False),
                        '|',
                            ('message_partner_ids', 'in', [user.partner_id.id]),
                            ('user_ids', 'in', user.id),
            ]</field>
        </record>
        <record model="ir.rule" id="hr_timesheet.timesheet_line_rule_user">
            <field name="domain_force">[
                '&amp;', '&amp;',
                    ('user_id', '=', user.id),
                    ('project_id', '!=', False),
                    '|', '|',
                        ('project_id.privacy_visibility', '!=', 'followers'),
                        ('message_partner_ids', 'in', [user.partner_id.id]),
                        '&amp;',
                            ('task_id', '!=', False),
                            '|',
                                ('task_id.user_ids', 'in', user.id),
                                ('task_id.involved_user_ids', 'in', user.id)
            ]</field>
        </record>
        <record model="ir.rule" id="hr_timesheet.timesheet_line_rule_approver">
            <field name="domain_force">[
                '&amp;', '&amp;',
                    ('project_id', '!=', False),
                    ('task_id', '!=', False),
                    '|',
                        '&amp;',
                            ('project_id.privacy_visibility', '=', 'followers'),
                            '|',
                                '|',
                                    ('project_id.project_lead', '=', user.id),
                                    ('project_id.user_id', '=', user.id),
                                '|',
                                    '&amp;',
                                        ('task_id.is_generic', '=', False),
                                        '|',
                                            ('user_id', 'in', 'task_id.user_ids'),
                                            ('user_id', 'in', 'task_id.involved_user_ids'),
                                    '&amp;',
                                        ('task_id.is_generic', '=', True),
                                        ('user_id.partner_id', 'in', 'project_id.message_partner_ids'),
                        '&amp;', '&amp;',
                            ('project_id.privacy_visibility', '!=', 'followers'),
                            ('task_id.is_generic', '=', False),
                            '|',
                                ('user_id', 'in', 'task_id.user_ids'),
                                ('user_id', 'in', 'task_id.involved_user_ids')
            ]</field>
        </record>
        <record model="ir.rule" id="project_task_involved_assignee_rule">
            <field name="name">Project/Task: involved assignees see involved tasks</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[('involved_user_ids', 'in', user.id)]</field>
            <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('project.group_project_user'))]"/>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="0"/>
            <field name="perm_unlink" eval="0"/>
        </record>

        <record model="ir.rule" id="timesheet_line_involved_assignee_rule">
            <field name="name">Timesheets: involved assignees can manage own lines</field>
            <field name="model_id" ref="analytic.model_account_analytic_line"/>
            <field name="domain_force">[
                '&amp;', '&amp;', '&amp;',
                    ('user_id', '=', user.id),
                    ('project_id', '!=', False),
                    ('task_id', '!=', False),
                    ('task_id.involved_user_ids', 'in', user.id)
            ]</field>
            <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('hr_timesheet.group_hr_timesheet_user'))]"/>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_unlink" eval="1"/>
        </record>
        <record model="ir.rule" id="user_task_availability_project_lead_rule">
            <field name="name">Task Availability: project lead: see all user tasks</field>
            <field name="model_id" ref="model_user_task_availability"/>
            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user'))]"/>
            <field name="domain_force">[
                    '|', '|',
                    ('project_id.project_lead', '=', user.id),
                    ('user_id', '=', user.id),
                    ('project_id.user_id', '=', user.id),
                ]
            </field>
        </record>

<!--        <record model="ir.rule" id="timesheet_users_normal_timesheets">-->
<!--            <field name="name">timesheet: users: see own tasks</field>-->
<!--            <field name="model_id" ref="analytic.model_account_analytic_line"/>-->
<!--            <field name="domain_force">[-->
<!--                '&amp;','&amp;', '&amp;', '&amp;', '&amp;','&amp;',-->
<!--                    ('project_id.privacy_visibility','=','followers'),-->
<!--                    ('task_id', '!=', False),-->
<!--                    ('project_id', '!=', False),-->
<!--                    ('project_id.project_lead', '!=', user.id),-->
<!--                    ('project_id.user_id', '!=', user.id),-->
<!--                    ('user_id','not in',[user.id]),-->
<!--                    '|',-->
<!--                        '&amp;',-->
<!--                            ('task_id.is_generic', '=', False),-->
<!--                            ('task_id.user_ids', 'not in', [user.id]),-->
<!--                        '&amp;',-->
<!--                            ('task_id.is_generic', '=', True),-->
<!--                            ('project_id.message_partner_ids', 'not in', [user.partner_id.id]),-->
<!--            ]</field>-->
<!--            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user')),(4,ref('project_task_timesheet_extended.group_project_supervisor')),(4,ref('hr_timesheet.group_hr_timesheet_user')),(4,ref('hr_timesheet.group_hr_timesheet_approver'))]"/>-->
<!--            <field name="perm_read" eval="0"/>-->
<!--            <field name="perm_unlink" eval="1"/>-->
<!--            <field name="perm_write" eval="1"/>-->
<!--            <field name="perm_create" eval="1"/>-->
<!--        </record>-->

<!--        <record model="ir.rule" id="timesheet_users_non_generic_timesheets">-->
<!--            <field name="name">timesheet: users: see own tasks</field>-->
<!--            <field name="model_id" ref="analytic.model_account_analytic_line"/>-->
<!--            <field name="domain_force">[-->
<!--                    ('project_id.privacy_visibility','!=','followers'),-->
<!--                    ('task_id', '!=', False),-->
<!--                    ('project_id', '!=', False),-->
<!--                    ('project_id.project_lead', '!=', user.id),-->
<!--                    ('project_id.user_id', '!=', user.id),-->
<!--                    ('task_id.is_generic', '=', False),-->
<!--                    ('task_id.user_ids', 'not in', [user.id]),-->
<!--                    ('user_id','not in',[user.id]),-->
<!--            ]</field>-->
<!--            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user')),(4,ref('project_task_timesheet_extended.group_project_supervisor')),(4,ref('hr_timesheet.group_hr_timesheet_user')),(4,ref('hr_timesheet.group_hr_timesheet_approver'))]"/>-->
<!--            <field name="perm_read" eval="0"/>-->
<!--            <field name="perm_unlink" eval="1"/>-->
<!--            <field name="perm_write" eval="1"/>-->
<!--            <field name="perm_create" eval="1"/>-->
<!--        </record>-->


<!--        <record model="ir.rule" id="timesheet_team_lead_normal_timesheets">-->
<!--            <field name="name">timesheet: Lead: see related tasks</field>-->
<!--            <field name="model_id" ref="analytic.model_account_analytic_line"/>-->
<!--            <field name="domain_force">[-->
<!--                '&amp;', '&amp;', '&amp;',-->
<!--                ('project_id', '!=', False),-->
<!--                ('project_id.project_lead', '=', user.id),-->
<!--                '|', ('task_id.is_generic', '=', True), ('task_id.is_generic', '=', False),-->
<!--                '|', ('task_id.user_ids', 'in', user.id), ('task_id.user_ids', 'not in', user.id)-->
<!--                ]-->
<!--            </field>-->
<!--            <field name="perm_read" eval="1"/>-->
<!--            <field name="perm_write" eval="1"/>-->
<!--            <field name="perm_create" eval="1"/>-->
<!--            <field name="perm_unlink" eval="0"/>-->
<!--        </record>-->
    </data>
    <data>

    </data>

</odoo>