Skip to content

Commit eea6628

Browse files
EmilioPascualEmilioPascual
committed
[ADD] hr_employee_bank_restrict: Restrict bank account visibility in employee contacts
Add visibility restriction for bank accounts field in partner contacts linked to employees via work_contact_id. Only users with account.group_account_user or account.group_account_manager can view bank accounts in employee contacts. Users with billing-only access (account.group_invoice) cannot view this data. MT-14341 @moduon
1 parent baff8ed commit eea6628

File tree

17 files changed

+962
-0
lines changed

17 files changed

+962
-0
lines changed

‎hr_employee_bank_restrict/README.rst‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
======================
2+
Employee bank restrict
3+
======================
4+
5+
..
6+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
7+
!! This file is generated by oca-gen-addon-readme !!
8+
!! changes will be overwritten. !!
9+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
10+
!! source digest: sha256:fcad4c62a0566610c4344fe2465e1456fb33f4c7fce25d0ae0bf90cafe928a15
11+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
12+
13+
.. |badge1| image:: https://img.shields.io/badge/maturity-Alpha-red.png
14+
:target: https://odoo-community.org/page/development-status
15+
:alt: Alpha
16+
.. |badge2| image:: https://img.shields.io/badge/licence-LGPL--3-blue.png
17+
:target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
18+
:alt: License: LGPL-3
19+
.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fhr-lightgray.png?logo=github
20+
:target: https://github.com/OCA/hr/tree/18.0/hr_employee_bank_restrict
21+
:alt: OCA/hr
22+
.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
23+
:target: https://translation.odoo-community.org/projects/hr-18-0/hr-18-0-hr_employee_bank_restrict
24+
:alt: Translate me on Weblate
25+
.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
26+
:target: https://runboat.odoo-community.org/builds?repo=OCA/hr&target_branch=18.0
27+
:alt: Try me on Runboat
28+
29+
|badge1| |badge2| |badge3| |badge4| |badge5|
30+
31+
Restrict visibility of bank accounts in contacts related to employees.
32+
33+
This module hides bank account information in partner contacts that are
34+
linked to employees, only allowing users with accounting full access
35+
(group_account_user or group_account_manager) to view this sensitive
36+
data.
37+
38+
Regular contacts (not related to employees) show bank accounts to all
39+
users as usual.
40+
41+
.. IMPORTANT::
42+
This is an alpha version, the data model and design can change at any time without warning.
43+
Only for development or testing purpose, do not use in production.
44+
`More details on development status <https://odoo-community.org/page/development-status>`_
45+
46+
**Table of contents**
47+
48+
.. contents::
49+
:local:
50+
51+
Use Cases / Context
52+
===================
53+
54+
This module was developed to protect sensitive banking information of
55+
employees.
56+
57+
In organizations where payroll or expense reimbursement is managed,
58+
employees need to provide their bank account details. These contacts are
59+
linked to employee records via the "Work Contact" field. It's common
60+
practice to restrict access to this sensitive data to only users who
61+
truly need it for payment processing.
62+
63+
It will be useful for you if:
64+
65+
- You manage employee payroll or expense reimbursements in Odoo.
66+
- You want to restrict access to employee bank account data.
67+
- You need to comply with data protection regulations (like GDPR).
68+
69+
Usage
70+
=====
71+
72+
To use this module, you need to:
73+
74+
1. Install the module in your Odoo database.
75+
76+
2. Ensure employees have their "Work Contact" field properly linked:
77+
78+
- Go to the "Employees" app.
79+
- Select an employee.
80+
- In the "Work Contact" field, verify the contact is set.
81+
82+
3. Verify the restriction works:
83+
84+
- As a user with accounting rights (Accounting User or Accounting
85+
Manager), open a contact linked to an employee. The bank accounts
86+
section should be visible.
87+
88+
- As a user without accounting rights (like Billing or Internal
89+
User), open a contact linked to an employee. The bank accounts
90+
section should be hidden.
91+
92+
4. For regular contacts (not related to employees), bank accounts are
93+
always visible to all users.
94+
95+
Bug Tracker
96+
===========
97+
98+
Bugs are tracked on `GitHub Issues <https://github.com/OCA/hr/issues>`_.
99+
In case of trouble, please check there if your issue has already been reported.
100+
If you spotted it first, help us to smash it by providing a detailed and welcomed
101+
`feedback <https://github.com/OCA/hr/issues/new?body=module:%20hr_employee_bank_restrict%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
102+
103+
Do not contact contributors directly about support or help with technical issues.
104+
105+
Credits
106+
=======
107+
108+
Authors
109+
-------
110+
111+
* Moduon
112+
113+
Contributors
114+
------------
115+
116+
- Emilio Pascual (`Moduon <https://www.moduon.team/>`__)
117+
118+
Maintainers
119+
-----------
120+
121+
This module is maintained by the OCA.
122+
123+
.. image:: https://odoo-community.org/logo.png
124+
:alt: Odoo Community Association
125+
:target: https://odoo-community.org
126+
127+
OCA, or the Odoo Community Association, is a nonprofit organization whose
128+
mission is to support the collaborative development of Odoo features and
129+
promote its widespread use.
130+
131+
.. |maintainer-EmilioPascual| image:: https://github.com/EmilioPascual.png?size=40px
132+
:target: https://github.com/EmilioPascual
133+
:alt: EmilioPascual
134+
.. |maintainer-rafaelbn| image:: https://github.com/rafaelbn.png?size=40px
135+
:target: https://github.com/rafaelbn
136+
:alt: rafaelbn
137+
138+
Current `maintainers <https://odoo-community.org/page/maintainer-role>`__:
139+
140+
|maintainer-EmilioPascual| |maintainer-rafaelbn|
141+
142+
This module is part of the `OCA/hr <https://github.com/OCA/hr/tree/18.0/hr_employee_bank_restrict>`_ project on GitHub.
143+
144+
You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

‎hr_employee_bank_restrict/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
from . import models

‎hr_employee_bank_restrict/__manifest__.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright 2026 Moduon Team S.L.
2+
# License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl-3.0)
3+
4+
{
5+
"name": "Employee bank restrict",
6+
"summary": "Restrict employee bank account in employee partner",
7+
"version": "18.0.1.0.0",
8+
"development_status": "Alpha",
9+
"category": "Human Resources/Employees",
10+
"website": "https://github.com/OCA/hr",
11+
"author": "Moduon, Odoo Community Association (OCA)",
12+
"maintainers": ["EmilioPascual", "rafaelbn"],
13+
"license": "LGPL-3",
14+
"application": False,
15+
"installable": True,
16+
"depends": [
17+
"hr", "account",
18+
],
19+
"data": [
20+
"views/res_partner_views.xml",
21+
],
22+
}

‎hr_employee_bank_restrict/i18n/es.po‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Translation of Odoo Server.
2+
# Copyright (C) 2026 Moduon Team SL
3+
# This file is distributed under the same license as the hr_employee_bank_restrict package.
4+
#
5+
msgid ""
6+
msgstr ""
7+
"Project-Id-Version: Odoo Server 18.0\n"
8+
"Report-Msgid-Bugs-To: \n"
9+
"POT-Creation-Date: 2026-04-08 14:35+0000\n"
10+
"PO-Revision-Date: 2026-04-08 16:37+0200\n"
11+
"Last-Translator: Emilio Pascual <emilio@moduon.team>\n"
12+
"Language-Team: Spanish\n"
13+
"Language: es\n"
14+
"MIME-Version: 1.0\n"
15+
"Content-Type: text/plain; charset=UTF-8\n"
16+
"Content-Transfer-Encoding: 8bit\n"
17+
"X-Generator: Poedit 3.6\n"
18+
19+
#. module: hr_employee_bank_restrict
20+
#: model:ir.model.fields,field_description:hr_employee_bank_restrict.field_res_partner__can_view_bank_accounts
21+
#: model:ir.model.fields,field_description:hr_employee_bank_restrict.field_res_users__can_view_bank_accounts
22+
msgid "Can View Bank Accounts"
23+
msgstr "Puede Ver Cuentas Bancarias"
24+
25+
#. module: hr_employee_bank_restrict
26+
#: model:ir.model,name:hr_employee_bank_restrict.model_res_partner
27+
msgid "Contact"
28+
msgstr "Contacto"

‎hr_employee_bank_restrict/i18n/hr_employee_bank_restrict.pot‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Translation of Odoo Server.
2+
# This file contains the translation of the following modules:
3+
# * hr_employee_bank_restrict
4+
#
5+
msgid ""
6+
msgstr ""
7+
"Project-Id-Version: Odoo Server 18.0\n"
8+
"Report-Msgid-Bugs-To: \n"
9+
"POT-Creation-Date: 2026-04-08 14:35+0000\n"
10+
"PO-Revision-Date: 2026-04-08 14:35+0000\n"
11+
"Last-Translator: \n"
12+
"Language-Team: \n"
13+
"MIME-Version: 1.0\n"
14+
"Content-Type: text/plain; charset=UTF-8\n"
15+
"Content-Transfer-Encoding: \n"
16+
"Plural-Forms: \n"
17+
18+
#. module: hr_employee_bank_restrict
19+
#: model:ir.model.fields,field_description:hr_employee_bank_restrict.field_res_partner__can_view_bank_accounts
20+
#: model:ir.model.fields,field_description:hr_employee_bank_restrict.field_res_users__can_view_bank_accounts
21+
msgid "Can View Bank Accounts"
22+
msgstr ""
23+
24+
#. module: hr_employee_bank_restrict
25+
#: model:ir.model,name:hr_employee_bank_restrict.model_res_partner
26+
msgid "Contact"
27+
msgstr ""

‎hr_employee_bank_restrict/models/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
from . import res_partner

‎hr_employee_bank_restrict/models/res_partner.py‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Copyright 2026 Moduon Team S.L.
2+
# License LGPL-3.0 or later (https://www.gnu.org/licenses/lgpl-3.0)
3+
4+
from odoo import api, fields, models
5+
6+
7+
class ResPartner(models.Model):
8+
_inherit = "res.partner"
9+
10+
def _is_employee_contact(self):
11+
"""Check if the partner is related to an employee as work contact.
12+
13+
Returns:
14+
bool: True if the partner is linked to an employee via work_contact_id.
15+
"""
16+
self.ensure_one()
17+
return (
18+
self.env["hr.employee"]
19+
.sudo()
20+
.search_count([("work_contact_id", "=", self.id)])
21+
)
22+
23+
def _check_can_view_bank_accounts(self):
24+
"""Check if the current user can view bank accounts in this partner.
25+
26+
Only users with accounting_full_access (group_account_user or
27+
group_account_manager) can view bank accounts in contacts
28+
related to employees. Regular contacts show bank accounts to all users.
29+
30+
Returns:
31+
bool: True if the user can view bank accounts for this partner.
32+
"""
33+
self.ensure_one()
34+
if not self._is_employee_contact():
35+
return True
36+
user = self.env.user
37+
if user.has_group("account.group_account_user"):
38+
return True
39+
if user.has_group("account.group_account_manager"):
40+
return True
41+
return False
42+
43+
can_view_bank_accounts = fields.Boolean(
44+
string="Can View Bank Accounts",
45+
compute="_compute_can_view_bank_accounts",
46+
store=False,
47+
compute_sudo=True,
48+
)
49+
50+
def _compute_can_view_bank_accounts(self):
51+
"""Compute the can_view_bank_accounts field for partners."""
52+
for partner in self:
53+
partner.can_view_bank_accounts = partner._check_can_view_bank_accounts()

‎hr_employee_bank_restrict/pyproject.toml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[build-system]
2+
requires = ["whool"]
3+
build-backend = "whool.buildapi"

‎hr_employee_bank_restrict/readme/CONTEXT.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
This module was developed to protect sensitive banking information of employees.
2+
3+
In organizations where payroll or expense reimbursement is managed, employees need to provide their bank account
4+
details. These contacts are linked to employee records via the "Work Contact" field. It's common
5+
practice to restrict access to this sensitive data to only users who truly need it for payment processing.
6+
7+
It will be useful for you if:
8+
9+
- You manage employee payroll or expense reimbursements in Odoo.
10+
- You want to restrict access to employee bank account data.
11+
- You need to comply with data protection regulations (like GDPR).

‎hr_employee_bank_restrict/readme/CONTRIBUTORS.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- Emilio Pascual ([Moduon](https://www.moduon.team/))

0 commit comments

Comments
 (0)