Employee Self-Service Portal
in Odoo 19

<!-- Ensure employees only see their own HR records -->
<record id="hr_employee_self_service_rule" model="ir.rule">
    <field name="name">Employee: Own Records Only</field>
    <field name="model_id" ref="hr.model_hr_employee"/>
    <field name="domain_force">
        [('user_id', '=', user.id)]
    </field>
    <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    <field name="perm_read" eval="True"/>
    <field name="perm_write" eval="True"/>
    <field name="perm_create" eval="False"/>
    <field name="perm_unlink" eval="False"/>
</record>

from odoo import models, fields, api
from odoo.exceptions import ValidationError


class HrExpenseCategoryExt(models.Model):
    _inherit = "hr.expense"

    # Add a maximum amount per expense category
    max_amount = fields.Float(
        related="product_id.standard_price",
        string="Policy Limit",
        readonly=True,
    )

    @api.constrains("total_amount_currency", "product_id")
    def _check_expense_policy_limit(self):
        for expense in self:
            limit = expense.product_id.standard_price
            if limit > 0 and expense.total_amount_currency > limit:
                raise ValidationError(
                    f"Expense amount ({expense.total_amount_currency}) "
                    f"exceeds the policy limit of {limit} "
                    f"for category '{expense.product_id.name}'. "
                    f"Please submit a separate justification to HR."
                )

# Install the extraction module
./odoo-bin -c /etc/odoo/odoo.conf \
  -i hr_expense_extract \
  --stop-after-init

# Verify the IAP account is configured:
# Settings > Technical > IAP Account
# The OCR service requires IAP credits (Odoo's pay-per-use API)

from odoo import models, fields, api


class HrExpenseSheetExt(models.Model):
    _inherit = "hr.expense.sheet"

    requires_director_approval = fields.Boolean(
        compute="_compute_requires_director",
        store=True,
    )

    @api.depends("total_amount")
    def _compute_requires_director(self):
        threshold = float(
            self.env["ir.config_parameter"]
            .sudo()
            .get_param("hr_expense.director_threshold", "1000")
        )
        for sheet in self:
            sheet.requires_director_approval = (
                sheet.total_amount > threshold
            )

    def action_approve_expense_sheets(self):
        """Override to add director gate for high-value sheets."""
        for sheet in self:
            if (
                sheet.requires_director_approval
                and not self.env.user.has_group(
                    "hr_expense.group_hr_expense_manager"
                )
            ):
                sheet.message_post(
                    body="This expense sheet exceeds the threshold "
                    "and requires director-level approval.",
                    subtype_xmlid="mail.mt_note",
                )
                continue
        return super().action_approve_expense_sheets()

from odoo import models, api

SENSITIVE_FIELDS = {"bank_account_id", "private_street", "private_city"}


class HrEmployeeNotify(models.Model):
    _inherit = "hr.employee"

    @api.model
    def _get_hr_notification_channel(self):
        """Return the HR officers to notify on sensitive changes."""
        return self.env.ref(
            "hr.group_hr_manager"
        ).users.mapped("partner_id")

    def write(self, vals):
        result = super().write(vals)
        changed_sensitive = set(vals.keys()) & SENSITIVE_FIELDS
        if changed_sensitive and not self.env.user.has_group(
            "hr.group_hr_user"
        ):
            for emp in self:
                field_labels = [
                    self._fields[f].string
                    for f in changed_sensitive
                    if f in self._fields
                ]
                emp.message_post(
                    body=(
                        f"<b>Self-service update:</b> "
                        f"{emp.name} modified: "
                        f"{', '.join(field_labels)}. "
                        f"Please verify this change."
                    ),
                    partner_ids=(
                        self._get_hr_notification_channel().ids
                    ),
                    subtype_xmlid="mail.mt_note",
                )
        return result

from odoo import models, fields


class BulkSignRequest(models.TransientModel):
    _name = "hr.bulk.sign.request"
    _description = "Send Signing Requests to Multiple Employees"

    template_id = fields.Many2one(
        "sign.template",
        string="Document Template",
        required=True,
    )
    employee_ids = fields.Many2many(
        "hr.employee",
        string="Employees",
        required=True,
    )
    subject = fields.Char(
        string="Email Subject",
        default="Document Requiring Your Signature",
    )

    def action_send_requests(self):
        """Create and send sign requests for each employee."""
        SignRequest = self.env["sign.request"]
        for emp in self.employee_ids:
            if not emp.work_email:
                continue
            sign_request = SignRequest.create({
                "template_id": self.template_id.id,
                "reference": (
                    f"{self.template_id.name} - {emp.name}"
                ),
                "request_item_ids": [(0, 0, {
                    "partner_id": emp.user_id.partner_id.id,
                    "role_id": self.env.ref(
                        "sign.sign_item_role_employee"
                    ).id,
                })],
            })
            sign_request.action_sent()
        return {
            "type": "ir.actions.client",
            "tag": "display_notification",
            "params": {
                "title": "Signing Requests Sent",
                "message": (
                    f"Sent {len(self.employee_ids)} "
                    f"signing request(s)."
                ),
                "type": "success",
            },
        }