analytic_hr_department_restriction

Purpose

Restricts analytic plans and accounts so users only see records tied to their HR department unless granted broader access.

Features

account.analytic.account: Adds a department assignment field to analytic accounts and shows it in views for managing HR-based visibility.
account.analytic.plan: Links analytic plans to departments and re-runs plan lookups so department filters apply even when the base search uses sudo.
ir.rule: Injects department-based domains that limit analytic plans and accounts to the user's employee department while allowing invoicing users full access.
security: Introduces a helper group letting analytic users view department-less records without requiring invoicing permissions.