odoo18/addons_extensions/project_task_timesheet_extended/security/security.xml

<?xml version="1.0" encoding="UTF-8" ?>
<odoo>
    <record id="group_project_supervisor" model="res.groups">
        <field name="name">Manager</field>
        <field name="category_id" ref="base.module_category_services_project"/>
        <field name="implied_ids" eval="[(4, ref('project.group_project_user'))]"/>
    </record>

    <record id="project.group_project_manager" model="res.groups">
        <field name="implied_ids" eval="[(4, ref('project.group_project_user')),(4, ref('group_project_supervisor')), (4, ref('mail.group_mail_canned_response_admin'))]"/>
    </record>

    <data>
        <record id="project_rule_manager_own_projects" model="ir.rule">
            <field name="name">Manager: Own Projects</field>
            <field name="model_id" ref="project.model_project_project"/>
            <field name="groups" eval="[(4, ref('project_task_timesheet_extended.group_project_supervisor'))]"/>
            <field name="domain_force">[('user_id', '=', user.id)]</field>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_unlink" eval="0"/>
        </record>

        <record model="ir.rule" id="project_supervisor_all_project_tasks_rule">
            <field name="name">Project/Task: project supervisor: see all tasks linked to his assigned project or its own tasks</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[
                ('project_id.user_id','=',user.id),
                '|', ('project_id', '!=', False),
                     ('user_ids', 'in', user.id),
            ]</field>
            <field name="groups" eval="[(4,ref('project_task_timesheet_extended.group_project_supervisor'))]"/>
        </record>

        <record model="ir.rule" id="project_users_project_tasks_rule">
            <field name="name">Project/Task: project users: don't see non generic tasks</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[
                '&amp;', '&amp;',
                ('project_id', '!=', False),
                ('is_generic', '=', False),
                ('user_ids', 'not in', user.id),
                ]
            </field>
            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user'))]"/>
            <field name="perm_read" eval="0"/>
        </record>

        <record model="ir.rule" id="project_users_project_lead_rule">
            <field name="name">Project/Task: project lead: see all tasks</field>
            <field name="model_id" ref="project.model_project_task"/>
            <field name="domain_force">[
                '&amp;', '&amp;', '&amp;',
                ('project_id', '!=', False),
                ('project_id.project_lead', '=', user.id),
                '|', ('is_generic', '=', True), ('is_generic', '=', False),
                '|', ('user_ids', 'in', user.id), ('user_ids', 'not in', user.id)
                ]
            </field>
            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user'))]"/>
            <field name="perm_read" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_unlink" eval="0"/>
        </record>

        <record model="ir.rule" id="user_task_availability_project_lead_rule">
            <field name="name">Task Availability: project lead: see all user tasks</field>
            <field name="model_id" ref="model_user_task_availability"/>
            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user'))]"/>
            <field name="domain_force">[
                    '|', '|',
                    ('project_id.project_lead', '=', user.id),
                    ('user_id', '=', user.id),
                    ('project_id.user_id', '=', user.id),
                ]
            </field>
        </record>

<!--        <record model="ir.rule" id="timesheet_users_normal_timesheets">-->
<!--            <field name="name">timesheet: users: see own tasks</field>-->
<!--            <field name="model_id" ref="analytic.model_account_analytic_line"/>-->
<!--            <field name="domain_force">[-->
<!--                '&amp;','&amp;', '&amp;', '&amp;', '&amp;','&amp;',-->
<!--                    ('project_id.privacy_visibility','=','followers'),-->
<!--                    ('task_id', '!=', False),-->
<!--                    ('project_id', '!=', False),-->
<!--                    ('project_id.project_lead', '!=', user.id),-->
<!--                    ('project_id.user_id', '!=', user.id),-->
<!--                    ('user_id','not in',[user.id]),-->
<!--                    '|',-->
<!--                        '&amp;',-->
<!--                            ('task_id.is_generic', '=', False),-->
<!--                            ('task_id.user_ids', 'not in', [user.id]),-->
<!--                        '&amp;',-->
<!--                            ('task_id.is_generic', '=', True),-->
<!--                            ('project_id.message_partner_ids', 'not in', [user.partner_id.id]),-->
<!--            ]</field>-->
<!--            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user')),(4,ref('project_task_timesheet_extended.group_project_supervisor')),(4,ref('hr_timesheet.group_hr_timesheet_user')),(4,ref('hr_timesheet.group_hr_timesheet_approver'))]"/>-->
<!--            <field name="perm_read" eval="0"/>-->
<!--            <field name="perm_unlink" eval="1"/>-->
<!--            <field name="perm_write" eval="1"/>-->
<!--            <field name="perm_create" eval="1"/>-->
<!--        </record>-->

<!--        <record model="ir.rule" id="timesheet_users_non_generic_timesheets">-->
<!--            <field name="name">timesheet: users: see own tasks</field>-->
<!--            <field name="model_id" ref="analytic.model_account_analytic_line"/>-->
<!--            <field name="domain_force">[-->
<!--                    ('project_id.privacy_visibility','!=','followers'),-->
<!--                    ('task_id', '!=', False),-->
<!--                    ('project_id', '!=', False),-->
<!--                    ('project_id.project_lead', '!=', user.id),-->
<!--                    ('project_id.user_id', '!=', user.id),-->
<!--                    ('task_id.is_generic', '=', False),-->
<!--                    ('task_id.user_ids', 'not in', [user.id]),-->
<!--                    ('user_id','not in',[user.id]),-->
<!--            ]</field>-->
<!--            <field name="groups" eval="[(4,ref('base.group_user')),(4,ref('project.group_project_user')),(4,ref('project_task_timesheet_extended.group_project_supervisor')),(4,ref('hr_timesheet.group_hr_timesheet_user')),(4,ref('hr_timesheet.group_hr_timesheet_approver'))]"/>-->
<!--            <field name="perm_read" eval="0"/>-->
<!--            <field name="perm_unlink" eval="1"/>-->
<!--            <field name="perm_write" eval="1"/>-->
<!--            <field name="perm_create" eval="1"/>-->
<!--        </record>-->


<!--        <record model="ir.rule" id="timesheet_team_lead_normal_timesheets">-->
<!--            <field name="name">timesheet: Lead: see related tasks</field>-->
<!--            <field name="model_id" ref="analytic.model_account_analytic_line"/>-->
<!--            <field name="domain_force">[-->
<!--                '&amp;', '&amp;', '&amp;',-->
<!--                ('project_id', '!=', False),-->
<!--                ('project_id.project_lead', '=', user.id),-->
<!--                '|', ('task_id.is_generic', '=', True), ('task_id.is_generic', '=', False),-->
<!--                '|', ('task_id.user_ids', 'in', user.id), ('task_id.user_ids', 'not in', user.id)-->
<!--                ]-->
<!--            </field>-->
<!--            <field name="perm_read" eval="1"/>-->
<!--            <field name="perm_write" eval="1"/>-->
<!--            <field name="perm_create" eval="1"/>-->
<!--            <field name="perm_unlink" eval="0"/>-->
<!--        </record>-->
    </data>
    <data>

    </data>

</odoo>