TA#85715 [14.0][IMP] porject_worksheet : approbation access from the portal

project_worksheet/__manifest__.py

@@ -4,7 +4,7 @@
 {
     "name": "Project Worksheet",
     "summary": "Manage field worksheets for project interventions",
-    "version": "14.0.2.0.0",
+    "version": "14.0.2.1.0",
     "category": "Project Management",
     "website": "https://github.com/OCA/project",
     "author": "Numigi, Odoo Community Association (OCA)",

project_worksheet/controllers/main.py

@@ -14,7 +14,6 @@ class ProjectWorksheetPortal(http.Controller):
         website=True,
     )
     def portal_worksheet_view(self, worksheet_id, access_token=None, **kw):
-        # Render the worksheet portal view
         worksheet = self._get_worksheet(worksheet_id, access_token)
         return request.render(
             "project_worksheet.portal_worksheet_template",
@@ -30,30 +29,43 @@ def portal_worksheet_view(self, worksheet_id, access_token=None, **kw):
     )
     def portal_worksheet_accept(self, worksheet_id, access_token=None, **kw):
         worksheet = self._get_worksheet(worksheet_id, access_token)
+        self._check_approval_access_rights(worksheet)
         self._validate_acceptance(worksheet, kw.get("confirm_checkbox"))
         worksheet.action_client_confirm()
         self._log_client_confirmation(worksheet)
         return request.redirect(worksheet.get_portal_url())
 
     def _get_worksheet(self, worksheet_id, access_token):
-        # Retrieve and validate worksheet access
         worksheet = request.env["project.worksheet"].sudo().browse(worksheet_id)
         self._check_worksheet_access(worksheet, access_token)
         return worksheet
 
     def _check_worksheet_access(self, worksheet, access_token):
-        # Raise 404 if token is invalid or worksheet does not exist
         if not worksheet.exists() or worksheet.access_token != access_token:
             raise request.not_found()
 
+    def _check_approval_access_rights(self, worksheet):
+        user = request.env.user
+        if user.has_group("base.group_user"):
+            self._check_manager_group(user, worksheet)
+
+    def _check_manager_group(self, user, worksheet):
+        if not user.has_group("project_worksheet.group_project_worksheet_manager"):
+            self._redirect_unauthorized(worksheet)
+
+    def _redirect_unauthorized(self, worksheet):
+        error_url = worksheet.get_portal_url(query_string="&error=unauthorized")
+        raise request.redirect(error_url)
+
     def _validate_acceptance(self, worksheet, confirm_checkbox):
-        # Redirect back with error if the checkbox was not checked
         if not confirm_checkbox:
-            error_url = worksheet.get_portal_url(query_string="&error=missing_confirmation")
-            raise request.redirect(error_url)
+            self._redirect_missing_confirmation(worksheet)
+
+    def _redirect_missing_confirmation(self, worksheet):
+        error_url = worksheet.get_portal_url(query_string="&error=missing_confirmation")
+        raise request.redirect(error_url)
 
     def _log_client_confirmation(self, worksheet):
-        # Log the signature/confirmation footprint in the chatter
         client_ip = request.httprequest.remote_addr
         message = _("Worksheet approved by client from IP: %s") % client_ip
         worksheet.message_post(body=message)

project_worksheet/i18n/fr.po

@@ -905,4 +905,9 @@ msgstr "jours"
 #. module: project_worksheet
 #: model_terms:ir.ui.view,arch_db:project_worksheet.report_worksheet_document
 msgid "to"
-msgstr "au"
+msgstr "au"
+
+#. module: project_worksheet
+#: model_terms:ir.ui.view,arch_db:project_worksheet.portal_worksheet_template
+msgid "You are not authorized to approve this worksheet."
+msgstr "Vous n'êtes pas autorisé à approuver cette feuille d'installation."

project_worksheet/models/project_worksheet.py

@@ -285,7 +285,7 @@ def _prepare_timesheet_vals(self, line):
             "employee_id": line.employee_id.id,
             "project_id": self.project_id.id,
             "task_id": line.task_id.id,
-            "name": line.name,
+            "name": line.name or "/",
             "unit_amount": line.unit_amount,
         }
 

project_worksheet/models/project_worksheet_line.py

@@ -36,7 +36,7 @@ class ProjectWorksheetLine(models.Model):
     )
     name = fields.Char(
         string="Description",
-        required=True,
+        required=False,
     )
     unit_amount = fields.Float(
         string="Hours",

project_worksheet/reports/project_worksheet_report.xml

@@ -74,7 +74,7 @@
                                 <td><span t-field="line.date"/></td>
                                 <td><span t-field="line.employee_id.name"/></td>
                                 <td><span t-field="line.task_id.name"/></td>
-                                <td><span t-field="line.name"/></td>
+                                <td class="text-break"><span t-field="line.name"/></td>
                                 <td class="text-right"><span t-field="line.unit_amount" t-options="{'widget': 'float_time'}"/></td>
                             </tr>
                         </t>

project_worksheet/views/portal_worksheet_templates.xml

@@ -15,10 +15,10 @@
                                 <strong>Supervisor:</strong> <t t-esc="worksheet.supervisor_id.name"/>
                             </div>
                         </div>
-
                         <table class="table table-sm">
                             <thead>
                                 <tr>
+                                    <th>Date</th>
                                     <th>Employee</th>
                                     <th>Task</th>
                                     <th>Description</th>
@@ -28,9 +28,10 @@
                             <tbody>
                                 <t t-foreach="worksheet.line_ids" t-as="line">
                                     <tr>
+                                        <td><t t-esc="line.date"/></td>
                                         <td><t t-esc="line.employee_id.name"/></td>
                                         <td><t t-esc="line.task_id.name"/></td>
-                                        <td><t t-esc="line.name"/></td>
+                                        <td class="text-break"><t t-esc="line.name"/></td>
                                         <td class="text-right"><t t-esc="line.unit_amount" t-options="{'widget': 'float_time'}"/></td>
                                     </tr>
                                 </t>
@@ -52,6 +53,9 @@
                                 <div t-if="error == 'missing_confirmation'" class="alert alert-danger mt-2">
                                     You must check the confirmation box to proceed.
                                 </div>
+                                <div t-if="error == 'unauthorized'" class="alert alert-danger mt-2">
+                                    You are not authorized to approve this worksheet.
+                                </div>
 
                                 <div class="form-check mt-4 mb-4">
                                     <input class="form-check-input" type="checkbox" name="confirm_checkbox" id="confirm_checkbox"/>