slapos_erp5: give read access to Open Order to sale/accountant people

master/bt5/slapos_erp5/LocalRolesTemplateItem/open_sale_order_module.xml

 <local_roles_item>
  <local_roles>
-  <role id='G-COMPANY'>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
+  <role id='F-SALE*'>
    <item>Auditor</item>
-   <item>Author</item>
   </role>
  </local_roles>
  <local_role_group_ids>
-  <local_role_group_id id='group'>
-    <principal id='G-COMPANY'>Auditor</principal>
-    <principal id='G-COMPANY'>Author</principal>
+  <local_role_group_id id='function'>
+    <principal id='F-ACCOUNTING*'>Auditor</principal>
+    <principal id='F-SALE*'>Auditor</principal>
   </local_role_group_id>
  </local_role_group_ids>
 </local_roles_item>
\ No newline at end of file

master/bt5/slapos_erp5/PortalTypeRolesTemplateItem/Open%20Sale%20Order%20Module.xml

 <type_roles>
-  <role id='Author; Auditor'>
-   <property id='title'>Group company</property>
-   <multi_property id='categories'>local_role_group/group</multi_property>
-   <multi_property id='category'>group/company</multi_property>
-   <multi_property id='base_category'>group</multi_property>
+  <role id='Auditor'>
+   <property id='title'>Accountant</property>
+   <multi_property id='categories'>local_role_group/function</multi_property>
+   <multi_property id='category'>function/accounting*</multi_property>
+   <multi_property id='base_category'>function</multi_property>
+  </role>
+  <role id='Auditor'>
+   <property id='title'>Sale</property>
+   <multi_property id='categories'>local_role_group/function</multi_property>
+   <multi_property id='category'>function/sale*</multi_property>
+   <multi_property id='base_category'>function</multi_property>
   </role>
 </type_roles>
\ No newline at end of file

master/bt5/slapos_erp5/PortalTypeRolesTemplateItem/Open%20Sale%20Order.xml

 <type_roles>
+  <role id='Auditor'>
+   <property id='title'>Accountant</property>
+   <multi_property id='categories'>local_role_group/function</multi_property>
+   <multi_property id='category'>function/accounting*</multi_property>
+   <multi_property id='base_category'>function</multi_property>
+  </role>
+  <role id='Auditor'>
+   <property id='title'>Sale</property>
+   <multi_property id='categories'>local_role_group/function</multi_property>
+   <multi_property id='category'>function/sale*</multi_property>
+   <multi_property id='base_category'>function</multi_property>
+  </role>
   <role id='Auditor'>
    <property id='title'>User</property>
    <property id='condition'>python: (here.getDestinationSection('', portal_type='Person') != '') and (context.getLedger("") == "automated")</property>

master/bt5/slapos_erp5/TestTemplateItem/portal_components/test.erp5.testSlapOSERP5GroupRoleSecurity.py

@@ -1380,7 +1380,6 @@ class TestSalePackingListModule(TestSlapOSGroupRoleSecurityMixin):
         ['F-SALE*', 'F-ACCOUNTING*', module.Base_getOwnerId()], False)
     self.assertRoles(module, 'F-SALE*', ['Auditor'])
     self.assertRoles(module, 'F-ACCOUNTING*', ['Auditor'])
-    self.assertRoles(module, 'F-SALE*', ['Auditor'])
     self.assertRoles(module, module.Base_getOwnerId(), ['Owner'])
 
 
@@ -1394,3 +1393,62 @@ class TestSalePackingList(TestSlapOSGroupRoleSecurityMixin):
     self.assertRoles(delivery, 'F-SALE*', ['Auditor'])
     self.assertRoles(delivery, 'F-ACCOUNTING*', ['Auditor'])
 
+
+class TestOpenSaleOrderModule(TestSlapOSGroupRoleSecurityMixin):
+  def test_OpenSaleOrderModule(self):
+    module = self.portal.open_sale_order_module
+    self.assertSecurityGroup(module,
+        ['F-SALE*', 'F-ACCOUNTING*', module.Base_getOwnerId()], False)
+    self.assertRoles(module, 'F-SALE*', ['Auditor'])
+    self.assertRoles(module, 'F-ACCOUNTING*', ['Auditor'])
+    self.assertRoles(module, module.Base_getOwnerId(), ['Owner'])
+
+
+class TestOpenSaleOrder(TestSlapOSGroupRoleSecurityMixin):
+  def test_OpenSaleOrder_default(self):
+    delivery = self.portal.open_sale_order_module.newContent(
+        portal_type='Open Sale Order')
+    self.assertSecurityGroup(delivery,
+        ['F-SALE*', 'F-ACCOUNTING*', self.user_id], False)
+    self.assertRoles(delivery, self.user_id, ['Owner'])
+    self.assertRoles(delivery, 'F-SALE*', ['Auditor'])
+    self.assertRoles(delivery, 'F-ACCOUNTING*', ['Auditor'])
+
+
+  def test_OpenSaleOrder_user(self):
+    reference = 'TESTPERSON-%s' % self.generateNewId()
+    person = self.portal.person_module.newContent(portal_type='Person',
+        reference=reference)
+    delivery = self.portal.open_sale_order_module.newContent(
+        portal_type='Open Sale Order')
+
+    delivery.edit(
+      ledger='automated',
+      destination_section_value=person
+    )
+    self.assertSecurityGroup(delivery,
+        ['F-SALE*', 'F-ACCOUNTING*', self.user_id, person.getUserId()], False)
+    self.assertRoles(delivery, self.user_id, ['Owner'])
+    self.assertRoles(delivery, 'F-SALE*', ['Auditor'])
+    self.assertRoles(delivery, 'F-ACCOUNTING*', ['Auditor'])
+    self.assertRoles(delivery, person.getUserId(), ['Auditor'])
+
+    delivery.edit(
+      ledger=None
+    )
+    self.assertSecurityGroup(delivery,
+        ['F-SALE*', 'F-ACCOUNTING*', self.user_id], False)
+    self.assertRoles(delivery, self.user_id, ['Owner'])
+    self.assertRoles(delivery, 'F-SALE*', ['Auditor'])
+    self.assertRoles(delivery, 'F-ACCOUNTING*', ['Auditor'])
+
+    delivery.edit(
+      ledger='automated',
+      destination_section_value=None
+    )
+    self.assertSecurityGroup(delivery,
+        ['F-SALE*', 'F-ACCOUNTING*', self.user_id], False)
+    self.assertRoles(delivery, self.user_id, ['Owner'])
+    self.assertRoles(delivery, 'F-SALE*', ['Auditor'])
+    self.assertRoles(delivery, 'F-ACCOUNTING*', ['Auditor'])
+

master/bt5/slapos_erp5/WorkflowTemplateItem/portal_workflow/local_permission_slapos_interaction_workflow/interaction_OpenSaleOrder_edit.xml

@@ -56,7 +56,7 @@
             <key> <string>trigger_method_id</string> </key>
             <value>
               <tuple>
-                <string>_setDestination.*</string>
+                <string>_setDestinationSection.*</string>
                 <string>_setLedger.*</string>
               </tuple>
             </value>