slapos_erp5: fixup Service local roles

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/cpu_load_percent.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/memory_used.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_account_validation.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_compute_node_subscription.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_acknowledgement.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_complaint.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_delete_acknowledgement.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_delete_reminder.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_information.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_invoice_cancellation.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_monitoring.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_spam.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_stop_acknowledgement.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_stop_reminder.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_crm_upgrade.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_discount.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_instance_cleanup.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_instance_hosting.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_instance_setup.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_instance_subscription.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_instance_update.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_netdrive_consumption.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_reservation_fee.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_reservation_refund.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_tax.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/slapos_virtual_master_subscription.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/LocalRolesTemplateItem/service_module/zero_emission_ratio.xml

 <local_roles_item>
  <local_roles>
+  <role id='F-ACCOUNTING*'>
+   <item>Auditor</item>
+  </role>
   <role id='F-CUSTOMER'>
    <item>Auditor</item>
   </role>

master/bt5/slapos_erp5/PortalTypeRolesTemplateItem/Service%20Module.xml

 <type_roles>
+  <role id='Auditor'>
+   <property id='title'>Accounting</property>
+   <property id='description'>`Sale` people can NOT create/modify `Service`. This comes from the `bt5`, and can be really fragile to change for now.</property>
+   <multi_property id='category'>function/accounting*</multi_property>
+   <multi_property id='base_category'>function</multi_property>
+  </role>
   <role id='Auditor'>
    <property id='title'>Project Compute Node Manager</property>
    <property id='description'>XXX TODO

master/bt5/slapos_erp5/PortalTypeRolesTemplateItem/Service.xml

 <type_roles>
+  <role id='Auditor'>
+   <property id='title'>Accounting</property>
+   <property id='description'>`Sale` people can NOT create/modify `Service`. This comes from the `bt5`, and can be really fragile to change for now.
+
+XXX TODO
+add local roles group</property>
+   <multi_property id='category'>function/accounting*</multi_property>
+   <multi_property id='base_category'>function</multi_property>
+  </role>
   <role id='Auditor'>
    <property id='title'>Project Compute Node Manager</property>
    <property id='description'>XXX TODO

master/bt5/slapos_erp5/TestTemplateItem/portal_components/test.erp5.testSlapOSERP5GroupRoleSecurity.py

@@ -1715,3 +1715,31 @@ class TestBusinessProcess(TestSlapOSGroupRoleSecurityMixin):
     self.assertRoles(delivery, 'F-SALE*', ['Auditor'])
     self.assertRoles(delivery, 'F-ACCOUNTING*', ['Auditor'])
 
+
+class TestServiceModule(TestSlapOSGroupRoleSecurityMixin):
+  def test_ServiceModule(self):
+    module = self.portal.service_module
+    # XXX why does this module acquires local roles
+    self.assertSecurityGroup(module,
+        ['F-SALE*', 'F-ACCOUNTING*', 'F-CUSTOMER', 'F-PRODUCTION*',
+         module.Base_getOwnerId()], True)
+    self.assertRoles(module, 'F-SALE*', ['Auditor'])
+    self.assertRoles(module, 'F-ACCOUNTING*', ['Auditor'])
+    self.assertRoles(module, 'F-CUSTOMER', ['Auditor'])
+    self.assertRoles(module, 'F-PRODUCTION*', ['Auditor'])
+    self.assertRoles(module, module.Base_getOwnerId(), ['Owner'])
+
+
+class TestService(TestSlapOSGroupRoleSecurityMixin):
+  def test_Service_default(self):
+    delivery = self.portal.service_module.newContent(
+        portal_type='Service')
+    self.assertSecurityGroup(delivery,
+        ['F-SALE*', 'F-ACCOUNTING*', 'F-CUSTOMER', 'F-PRODUCTION*',
+         self.user_id], False)
+    self.assertRoles(delivery, self.user_id, ['Owner'])
+    self.assertRoles(delivery, 'F-SALE*', ['Auditor'])
+    self.assertRoles(delivery, 'F-ACCOUNTING*', ['Auditor'])
+    self.assertRoles(delivery, 'F-CUSTOMER', ['Auditor'])
+    self.assertRoles(delivery, 'F-PRODUCTION*', ['Auditor'])
+