From 2c4954703e72dc1ec080e71cf7c1bd4746c8b3d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Sat, 10 Apr 2021 23:46:24 +0200
Subject: [PATCH] Check rule only if _check_access is set and enforce companies
 rule

issue4080
review343891009
---
 sale.xml           |  10 ++---
 sale_reporting.xml | 108 +++++++++++++++++++++++++++++++++++++++++++++
 tests/test_sale.py |   6 +--
 3 files changed, 115 insertions(+), 9 deletions(-)

diff --git a/sale.xml b/sale.xml
index 9c8166a8f9..d832b6686a 100644
--- a/sale.xml
+++ b/sale.xml
@@ -470,16 +470,16 @@ this repository contains the full copyright notices and license terms. -->
                 pyson="1"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_sale">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_sale_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'sale.sale')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_sale1">
+        <record model="ir.rule" id="rule_sale_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_sale"/>
+            <field name="rule_group" ref="rule_group_sale_companies"/>
         </record>
 
         <record model="ir.model.access" id="access_invoice_sale">
diff --git a/sale_reporting.xml b/sale_reporting.xml
index 584f3300ae..9857a7fc3e 100644
--- a/sale_reporting.xml
+++ b/sale_reporting.xml
@@ -68,6 +68,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_customer"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_customer_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.customer')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_customer_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_customer_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_customer">
             <field name="model" search="[('model', '=', 'sale.reporting.customer')]"/>
             <field name="perm_read" eval="False"/>
@@ -133,6 +145,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_customer_time_series"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_customer_time_series_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.customer.time_series')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_customer_time_series_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_customer_time_series_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_customer_time_series">
             <field name="model" search="[('model', '=', 'sale.reporting.customer.time_series')]"/>
             <field name="perm_read" eval="False"/>
@@ -195,6 +219,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_product"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_product_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.product')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_product_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_product_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_product">
             <field name="model" search="[('model', '=', 'sale.reporting.product')]"/>
             <field name="perm_read" eval="False"/>
@@ -259,6 +295,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_product_time_series"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_product_time_series_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.product.time_series')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_product_time_series_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_product_time_series_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_product_time_series">
             <field name="model" search="[('model', '=', 'sale.reporting.product.time_series')]"/>
             <field name="perm_read" eval="False"/>
@@ -327,6 +375,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_category"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_category_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.category')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_category_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_category_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_category">
             <field name="model" search="[('model', '=', 'sale.reporting.category')]"/>
             <field name="perm_read" eval="False"/>
@@ -392,6 +452,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_category_time_series"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_category_time_series_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.category.time_series')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_category_time_series_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_category_time_series_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_category_time_series">
             <field name="model" search="[('model', '=', 'sale.reporting.category.time_series')]"/>
             <field name="perm_read" eval="False"/>
@@ -434,6 +506,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_region"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_region_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.region')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_region_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_region_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_region">
             <field name="model" search="[('model', '=', 'sale.reporting.region')]"/>
             <field name="perm_read" eval="False"/>
@@ -493,6 +577,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="act_window" ref="act_reporting_country_time_series"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_country_time_series_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.country.time_series')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_country_time_series_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_country_time_series_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_country_time_series">
             <field name="model" search="[('model', '=', 'sale.reporting.country.time_series')]"/>
             <field name="perm_read" eval="False"/>
@@ -553,6 +649,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="act_window" ref="act_reporting_country_subdivision_time_series"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_country_subdivision_time_series_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'sale.reporting.country.subdivision.time_series')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_country_subdivision_time_series_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_country_subdivision_time_series_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_country_subdivision_time_series">
             <field name="model" search="[('model', '=', 'sale.reporting.country.subdivision.time_series')]"/>
             <field name="perm_read" eval="False"/>
diff --git a/tests/test_sale.py b/tests/test_sale.py
index 31ad6d5d5b..da5ff771fe 100644
--- a/tests/test_sale.py
+++ b/tests/test_sale.py
@@ -12,13 +12,11 @@ from trytond.pool import Pool
 
 from trytond.modules.account.tests import create_chart
 from trytond.modules.company.tests import (
-    create_company, set_company, PartyCompanyCheckEraseMixin,
-    CompanyMultiValueTestMixin)
+    create_company, set_company, PartyCompanyCheckEraseMixin, CompanyTestMixin)
 
 
 class SaleTestCase(
-        PartyCompanyCheckEraseMixin, CompanyMultiValueTestMixin,
-        ModuleTestCase):
+        PartyCompanyCheckEraseMixin, CompanyTestMixin, ModuleTestCase):
     'Test Sale module'
     module = 'sale'