[IMP] account: Secured group usability

Current behavior:
As of now, whenever a journal is set to "Hash on Post", the user is
granted the secured group rights. This allows the user to see the
lock icon in the status bar, the extra default filters in the list
views of Journal Entries and Journal Items, and access to the Secure
Entries wizard.

However, if only entries from journals with "Hash on Post" are secured,
these features are not necessary. The user trusts Odoo to hash any and
all entries that are posted in that specific journal.

Expected behavior:
When "Hash on Post" is active, the user does not need any additional
user group. However, if even one entry is secured and does not belong
to a journal with the "hash on post" feature, the user will then need
access to the new features, such as the lock icon, default filters,
and the Secure Entries wizard.

Approach:
This commit removes the calls to _activate_group_account_secured()
when setting a journal to "Hash on Post". It also removes it from
the Secure Entries wizard. Instead, we add the key
'journal_restrict_mode' to the chains_to_hash, which indicates the
value of the journal's restrict_mode_hash_table field. If at least
one chain with moves does not have 'journal_restrict_mode', only
then we call _activate_group_account_secured() from _hash_moves().
This will only happen when the Secure Entries wizard is used,
hashing entries from all journals.

task-4348380

closes odoo/odoo#196748

Signed-off-by: William André (wan) <wan@odoo.com>

3 files changed, 7 insertions, 8 deletions

diff --git a/addons/account/models/account_journal.py b/addons/account/models/account_journal.py
index c5a039a5529..b3b79dbc079 100644
--- a/addons/account/models/account_journal.py
+++ b/addons/account/models/account_journal.py
@@ -678,9 +678,6 @@ class AccountJournal(models.Model):
             for journal in self.filtered(lambda r: r.type == 'bank' and not r.bank_account_id):
                 journal.set_bank_account(vals.get('bank_acc_number'), vals.get('bank_id'))
 
-        if vals.get('restrict_mode_hash_table'):
-            self.env['res.groups']._activate_group_account_secured()
-
         return result
 
     def _alias_get_creation_values(self):
@@ -880,9 +877,6 @@ class AccountJournal(models.Model):
             if journal.type == 'bank' and not journal.bank_account_id and vals.get('bank_acc_number'):
                 journal.set_bank_account(vals.get('bank_acc_number'), vals.get('bank_id'))
 
-        if any(journals.mapped('restrict_mode_hash_table')):
-            self.env['res.groups']._activate_group_account_secured()
-
         return journals
 
     def set_bank_account(self, acc_number, bank_id=None):
diff --git a/addons/account/models/account_move.py b/addons/account/models/account_move.py
index a33ff499316..4785233eb83 100644
--- a/addons/account/models/account_move.py
+++ b/addons/account/models/account_move.py
@@ -3839,11 +3839,17 @@ class AccountMove(models.Model):
 
     def _hash_moves(self, **kwargs):
         chains_to_hash = self._get_chains_to_hash(**kwargs)
+        grant_secure_group_access = False
         for chain in chains_to_hash:
             move_hashes = chain['moves']._calculate_hashes(chain['previous_hash'])
             for move, move_hash in move_hashes.items():
                 move.inalterable_hash = move_hash
+            # If any secured entries belong to journals without 'hash on post', the user should be granted access rights
+            if not chain['journal_restrict_mode']:
+                grant_secure_group_access = True
             chain['moves']._message_log_batch(bodies={m.id: self.env._("This journal entry has been secured.") for m in chain['moves']})
+        if grant_secure_group_access:
+            self.env['res.groups']._activate_group_account_secured()
 
     def _get_chain_info(self, force_hash=False, include_pre_last_hash=False, early_stop=False):
         """All records in `self` must belong to the same journal and sequence_prefix
@@ -3928,6 +3934,7 @@ class AccountMove(models.Model):
 
                 if not chain_info:
                     continue
+                chain_info['journal_restrict_mode'] = journal.restrict_mode_hash_table
                 if early_stop:
                     return True
 
diff --git a/addons/account/wizard/account_secure_entries_wizard.py b/addons/account/wizard/account_secure_entries_wizard.py
index 3f77c571ff2..7c8772c3d47 100644
--- a/addons/account/wizard/account_secure_entries_wizard.py
+++ b/addons/account/wizard/account_secure_entries_wizard.py
@@ -259,8 +259,6 @@ class AccountSecureEntries(models.TransientModel):
         if not self.hash_date:
             raise UserError(_("Set a date. The moves will be secured up to including this date."))
 
-        self.env['res.groups']._activate_group_account_secured()
-
         if not self.move_to_hash_ids:
             return