[hr_expense] By default an "HR user" can approve their own expenses

[James Jesudason]

By default, anyone in the "HR / User" group can approve their own expenses.

A better default would be to allow "HR / Managers" (or even an "HR / Expense Approver") to be able to approve expenses. Also, the user should only be able to approve the expenses of those that they manage (not any expense within the system).

In general terms, no one in the system should be able to approve their own expenses (perhaps there could be a group to represent those top-level users that are allowed to do so).

[Amit Parik (amit-parik)]

Hello James,

I have checked your issue. But we defined the hr user as the person who work in hr department or who is manager of a department so he has the right to approve an expense or a holiday. And he can approve his own doc. So i am closing this bug.

Thanks.

[James Jesudason (jamesj)]

Hi Amit,

I think you're wrong on this: a user *has* to be a member of the "HR User" group to be able to enter expenses. Otherwise they don't have permissions to read hr.department and therefore cannot create an expense record. I've verified this on the latest trunk using the demo data.

This problem is very similar to Bug #689637, which has been accepted and fixed.

[James Jesudason (jamesj)]

I've done some further testing as I am evaluating whether we can use this module in our company. From what I can see, there are major problems with the default implementation:

1. A user cannot enter expenses unless they are a member of the "HR User" group.
2. Any user that is a member of the "HR User" group can approve *any* expense, including their own.
3. All users can see expenses entered by *any* user.

Even if you fixed problem #1, that doesn't resolve issues #2 or #3. The current defaults in this module could not be used by any company that I have worked for.

[Amit Parik (amit-parik)]

Hello James,

You are right, and that's why i have set it as an "Opinion" not a "won't fix" or "invalid".

Thanks.

[Amit Parik (amit-parik)]

Hi james,

I have tested your whole scenario. But all are working as expected.
We have made a record rule for the HR/User and HR/Manager.
For that the HR/User can see only his expenses so he can only approve and create his expenses and HR/Manager can see the all user's expenses and also approve it. I have created the two users and for first user i gave only group HR/User and for the second i gave both HR/user and HR/Manager. So first user can see only his expanses and second can see all user's expanses.
Hope you will agree with this.

So all are works fine and i am closing this bug now.

I have attached a screen-shots for your reference. So please check it.

Thanks.

[James Jesudason (jamesj)]

But that is exactly my point: you have to add customisations to make it work reasonably. The rules should be a part of the default installation, not something that you have to add to make it usable.

[Amit Parik (amit-parik)]

Hello James,

This is not a customization. The record rule will be set automatically when you install hr_expense module.
The record rule was created in hr_expenses/security/ir.rule.xml file which is written in th __openerp__.py file. So at the installation time the record rule will be set.

Thanks.