From a9236ca5d3a6fc94b009f892ab5b43713be7fc66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Sat, 10 Apr 2021 23:46:23 +0200
Subject: [PATCH] Check rule only if _check_access is set and enforce companies
 rule

issue4080
review343891009
---
 account.xml           | 60 +++++++++++++++++++++----------------------
 fiscalyear.xml        | 10 ++++----
 move.xml              | 39 ++++++++++++++++++++++++++++
 move_template.xml     | 13 ++++++++++
 period.xml            | 10 ++++----
 tax.xml               | 30 +++++++++++-----------
 tests/test_account.py |  6 ++---
 7 files changed, 109 insertions(+), 59 deletions(-)

diff --git a/account.xml b/account.xml
index 9a1ec511cf..6767c88c7b 100644
--- a/account.xml
+++ b/account.xml
@@ -210,17 +210,17 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="True"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_account_type">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_account_type_companies">
+            <field name="name">User in companies</field>
             <field name="model"
                 search="[('model', '=', 'account.account.type')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_account_type1">
+        <record model="ir.rule" id="rule_account_type_companies">
             <field name="domain"
-                eval="[('company', 'in', Eval('user', {}).get('companies', []))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_account_type"/>
+            <field name="rule_group" ref="rule_group_account_type_companies"/>
         </record>
 
         <record model="ir.action.report" id="report_account_type_statement">
@@ -488,16 +488,16 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="True"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_account">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_account_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.account')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_account1">
+        <record model="ir.rule" id="rule_account_companies">
             <field name="domain"
-                eval="[('company', 'in', Eval('user', {}).get('companies', []))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_account"/>
+            <field name="rule_group" ref="rule_group_account_companies"/>
         </record>
 
         <record model="ir.ui.view" id="open_chart_start_view_form">
@@ -591,17 +591,17 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="False"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_general_ledger_account">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_general_ledger_account_companies">
+            <field name="name">User in companies</field>
             <field name="model"
                 search="[('model', '=', 'account.general_ledger.account')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_general_ledger_account1">
+        <record model="ir.rule" id="rule_general_ledger_account_companies">
             <field name="domain"
-                eval="[('company', 'in', Eval('user', {}).get('companies', []))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_general_ledger_account"/>
+            <field name="rule_group" ref="rule_group_general_ledger_account_companies"/>
         </record>
 
         <record model="ir.ui.view" id="general_ledger_account_party_view_list">
@@ -673,17 +673,17 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="False"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_general_ledger_account_party">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_general_ledger_account_party_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.general_ledger.account.party')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_general_ledger_account_party1">
+        <record model="ir.rule" id="rule_general_ledger_account_party_companies">
             <field
                 name="domain"
-                eval="[('company', 'in', Eval('user', {}).get('companies', []))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_general_ledger_account_party"/>
+            <field name="rule_group" ref="rule_group_general_ledger_account_party_companies"/>
         </record>
 
         <record model="ir.ui.view" id="general_ledger_line_view_list">
@@ -712,17 +712,17 @@ this repository contains the full copyright notices and license terms. -->
         </record>
         <!-- TODO relate from account -->
 
-        <record model="ir.rule.group" id="rule_group_general_ledger_line">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_general_ledger_line_companies">
+            <field name="name">User in companies</field>
             <field name="model"
                 search="[('model', '=', 'account.general_ledger.line')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_general_ledger_line1">
+        <record model="ir.rule" id="rule_general_ledger_line_companies">
             <field name="domain"
-                eval="[('company', 'in', Eval('user', {}).get('companies', []))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_general_ledger_line"/>
+            <field name="rule_group" ref="rule_group_general_ledger_line_companies"/>
         </record>
 
         <record model="ir.ui.view" id="general_ledger_account_context_view_form">
@@ -852,16 +852,16 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="False"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_aged_balance">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_aged_balance_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.aged_balance')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_aged_balance1">
+        <record model="ir.rule" id="rule_aged_balance_companies">
             <field name="domain"
-                eval="[('company', 'in', Eval('user', {}).get('companies', []))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_aged_balance"/>
+            <field name="rule_group" ref="rule_group_aged_balance_companies"/>
         </record>
 
         <record model="ir.ui.view" id="aged_balance_context_view_form">
diff --git a/fiscalyear.xml b/fiscalyear.xml
index 28491c6558..302bfddb65 100644
--- a/fiscalyear.xml
+++ b/fiscalyear.xml
@@ -85,16 +85,16 @@ this repository contains the full copyright notices and license terms. -->
             <field name="model" search="[('model', '=', 'account.fiscalyear')]"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_fiscalyear">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_fiscalyear_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.fiscalyear')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_fiscalyear1">
+        <record model="ir.rule" id="rule_fiscalyear_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_fiscalyear"/>
+            <field name="rule_group" ref="rule_group_fiscalyear_companies"/>
         </record>
 
         <record model="ir.action.act_window" id="act_fiscalyear_form_close">
diff --git a/move.xml b/move.xml
index 3ff8b0eac5..eac402d27b 100644
--- a/move.xml
+++ b/move.xml
@@ -39,6 +39,19 @@ this repository contains the full copyright notices and license terms. -->
             sequence="50"
             id="menu_move_form"/>
 
+        <record model="ir.rule.group" id="rule_group_move_companies">
+            <field name="name">User in companies</field>
+            <field name="model"
+                search="[('model', '=', 'account.move')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_move_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_move_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_move">
             <field name="model" search="[('model', '=', 'account.move')]"/>
             <field name="perm_read" eval="False"/>
@@ -105,6 +118,19 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_move_reconciliation_lines"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_move_reconciliation_companies">
+            <field name="name">User in companies</field>
+            <field name="model"
+                search="[('model', '=', 'account.move.reconciliation')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_move_reconciliation_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_move_reconciliation_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_move_reconciliation">
             <field name="model" search="[('model', '=', 'account.move.reconciliation')]"/>
             <field name="perm_read" eval="False"/>
@@ -371,6 +397,19 @@ this repository contains the full copyright notices and license terms. -->
             sequence="20"
             id="menu_reconcile_writeoff_form"/>
 
+        <record model="ir.rule.group" id="rule_group_reconcile_writeoff_companies">
+            <field name="name">User in companies</field>
+            <field name="model"
+                search="[('model', '=', 'account.move.reconcile.write_off')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reconcile_writeoff_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reconcile_writeoff_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reconcile_writeoff">
             <field name="model" search="[('model', '=', 'account.move.reconcile.write_off')]"/>
             <field name="perm_read" eval="True"/>
diff --git a/move_template.xml b/move_template.xml
index 784e2f6d8a..4336a385eb 100644
--- a/move_template.xml
+++ b/move_template.xml
@@ -38,6 +38,19 @@ this repository contains the full copyright notices and license terms. -->
             sequence="10"
             id="menu_move_template_form"/>
 
+        <record model="ir.rule.group" id="rule_group_move_template_companies">
+            <field name="name">User in companies</field>
+            <field name="model"
+                search="[('model', '=', 'account.move.template')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_move_template_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_move_template_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_move_template">
             <field name="model" search="[('model', '=', 'account.move.template')]"/>
             <field name="perm_read" eval="False"/>
diff --git a/period.xml b/period.xml
index 6f0b2e5b2d..4131f2af29 100644
--- a/period.xml
+++ b/period.xml
@@ -88,16 +88,16 @@ this repository contains the full copyright notices and license terms. -->
             sequence="30"
             id="menu_close_period"/>
 
-        <record model="ir.rule.group" id="rule_group_period">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_period_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.period')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_period1">
+        <record model="ir.rule" id="rule_period_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_period"/>
+            <field name="rule_group" ref="rule_group_period_companies"/>
         </record>
     </data>
 </tryton>
diff --git a/tax.xml b/tax.xml
index 104144e556..6f9fd86f29 100644
--- a/tax.xml
+++ b/tax.xml
@@ -200,16 +200,16 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_create" eval="True"/>
             <field name="perm_delete" eval="True"/>
         </record>
-        <record model="ir.rule.group" id="rule_group_tax_code">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_tax_code_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.tax.code')]" />
             <field name="global_p" eval="True" />
         </record>
-        <record model="ir.rule" id="rule_tax_code1">
+        <record model="ir.rule" id="rule_tax_code_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_tax_code" />
+            <field name="rule_group" ref="rule_group_tax_code_companies" />
         </record>
 
         <record model="ir.ui.view" id="tax_code_line_template_view_form">
@@ -333,16 +333,16 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="True"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_tax">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_tax_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.tax')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_tax1">
+        <record model="ir.rule" id="rule_tax_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_tax"/>
+            <field name="rule_group" ref="rule_group_tax_companies"/>
         </record>
 
         <record model="ir.action.wizard" id="wizard_tax_test">
@@ -497,16 +497,16 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="True"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_tax_rule">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_tax_rule_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'account.tax.rule')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_tax_rule1">
+        <record model="ir.rule" id="rule_tax_rule_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_tax_rule"/>
+            <field name="rule_group" ref="rule_group_tax_rule_companies"/>
         </record>
 
         <record model="ir.ui.view" id="tax_rule_line_template_view_form">
diff --git a/tests/test_account.py b/tests/test_account.py
index 63954cfef7..653678d7f5 100644
--- a/tests/test_account.py
+++ b/tests/test_account.py
@@ -15,8 +15,7 @@ from trytond.exceptions import UserError
 
 from trytond.modules.account.tax import TaxableMixin
 from trytond.modules.company.tests import (
-    create_company, set_company, PartyCompanyCheckEraseMixin,
-    CompanyMultiValueTestMixin)
+    create_company, set_company, PartyCompanyCheckEraseMixin, CompanyTestMixin)
 from trytond.modules.currency.tests import create_currency
 
 
@@ -174,8 +173,7 @@ def close_fiscalyear(fiscalyear):
 
 
 class AccountTestCase(
-        PartyCompanyCheckEraseMixin, CompanyMultiValueTestMixin,
-        ModuleTestCase):
+        PartyCompanyCheckEraseMixin, CompanyTestMixin, ModuleTestCase):
     'Test Account module'
     module = 'account'