Read ids from the table even without columns if a rule domain exists

The rule must be enforced also when only non SQL type fields are read.

Closes #12428
(grafted from bd69f1025bca6648fd9ff11f585a60214d2bbf6e)

--HG--
branch : 6.0

trytond/CHANGELOG

@@ -1,3 +1,4 @@
+* Enforce record rules when reading only non SQL fields (#12428)
 
 Version 6.0.33 - 2023-06-21
 ---------------------------

trytond/trytond/model/modelsql.py

@@ -768,7 +768,7 @@ class ModelSQL(ModelStorage):
                         Coalesce(table.write_date, table.create_date)
                         ).cast(sql_type).as_('_timestamp'))
 
-        if len(columns):
+        if len(columns) or domain:
             if 'id' not in fields_names:
                 columns.append(table.id.as_('id'))
 

trytond/trytond/tests/test_rule.py

@@ -319,6 +319,33 @@ class ModelRuleTestCase(unittest.TestCase):
         with self.assertRaisesRegex(AccessError, "Field different from foo"):
             TestRule.read([test.id], ['field'])
 
+    @with_transaction(context=_context)
+    def test_perm_read_with_rule_no_sql_type_fail(self):
+        "Test read with rule fail and without SQL type"
+        pool = Pool()
+        TestRule = pool.get('test.rule')
+        RuleGroup = pool.get('ir.rule.group')
+        Model = pool.get('ir.model')
+
+        model, = Model.search([('model', '=', 'test.rule')])
+        rule_group, = RuleGroup.create([{
+                    'name': "Field different from foo",
+                    'model': model.id,
+                    'global_p': True,
+                    'perm_read': True,
+                    'perm_create': False,
+                    'perm_write': False,
+                    'perm_delete': False,
+                    'rules': [('create', [{
+                                    'domain': json.dumps(
+                                        [('field', '!=', 'foo')]),
+                                    }])],
+                    }])
+        test, = TestRule.create([{'field': 'foo'}])
+
+        with self.assertRaisesRegex(AccessError, "Field different from foo"):
+            TestRule.read([test.id], ['rec_name'])
+
     @with_transaction(context=_context)
     def test_search_without_rule(self):
         "Test search without rule"