From ca9d4a3b6314ae95dfad5823b5aaec75642d5c5e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Sat, 10 Apr 2021 23:46:24 +0200
Subject: [PATCH] Check rule only if _check_access is set and enforce companies
 rule

issue4080
review343891009
---
 inventory.xml              | 12 +++++++++
 move.xml                   | 10 +++----
 period.xml                 | 12 +++++++++
 product.xml                | 32 +++++++++++++++-------
 shipment.xml               | 54 ++++++++++++++++++++------------------
 stock_reporting_margin.xml | 48 +++++++++++++++++++++++++++++++++
 tests/test_stock.py        |  6 ++---
 7 files changed, 130 insertions(+), 44 deletions(-)

diff --git a/inventory.xml b/inventory.xml
index 730721e63e..7b3d887176 100644
--- a/inventory.xml
+++ b/inventory.xml
@@ -84,6 +84,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_inventory_line_relate"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_inventory_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'stock.inventory')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_inventory_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_inventory_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_inventory">
             <field name="model" search="[('model', '=', 'stock.inventory')]"/>
             <field name="perm_read" eval="False"/>
diff --git a/move.xml b/move.xml
index e85a9fb2d1..491536996d 100644
--- a/move.xml
+++ b/move.xml
@@ -94,16 +94,16 @@ this repository contains the full copyright notices and license terms. -->
             <field name="group" ref="group_stock_admin"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_move">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_move_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.move')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_move">
+        <record model="ir.rule" id="rule_move_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_move"/>
+            <field name="rule_group" ref="rule_group_move_companies"/>
         </record>
 
         <record model="ir.model.access" id="access_move">
diff --git a/period.xml b/period.xml
index 56b2ef4f6e..e9286c2966 100644
--- a/period.xml
+++ b/period.xml
@@ -34,6 +34,18 @@ this repository contains the full copyright notices and license terms. -->
             sequence="30"
             id="menu_period_list"/>
 
+        <record model="ir.rule.group" id="rule_group_period_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'stock.period')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_period_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_period_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_period">
             <field name="model" search="[('model', '=', 'stock.period')]"/>
             <field name="perm_read" eval="False"/>
diff --git a/product.xml b/product.xml
index 548552c649..eecfc41080 100644
--- a/product.xml
+++ b/product.xml
@@ -77,6 +77,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_product_cost_price_revision"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_product_cost_price_revision_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'product.cost_price.revision')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_product_cost_price_revision_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_product_cost_price_revision_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_product_cost_price_revision">
             <field name="model" search="[('model', '=', 'product.cost_price.revision')]"/>
             <field name="perm_read" eval="True"/>
@@ -269,17 +281,17 @@ this repository contains the full copyright notices and license terms. -->
             <field name="act_window" ref="act_product_quantities_warehouse"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_product_quantities_warehouse">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_product_quantities_warehouse_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.product_quantities_warehouse')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_product_quantities_warehouse">
+        <record model="ir.rule" id="rule_product_quantities_warehouse_companies">
             <field
                 name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_product_quantities_warehouse"/>
+            <field name="rule_group" ref="rule_group_product_quantities_warehouse_companies"/>
         </record>
 
         <record model="ir.model.access" id="access_product_quantities_warehouse">
@@ -370,17 +382,17 @@ this repository contains the full copyright notices and license terms. -->
             <field name="group" ref="group_stock"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_product_quantities_warehouse_move">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_product_quantities_warehouse_move_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.product_quantities_warehouse.move')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_product_quantities_warehouse_move">
+        <record model="ir.rule" id="rule_product_quantities_warehouse_move_companies">
             <field
                 name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_product_quantities_warehouse_move"/>
+            <field name="rule_group" ref="rule_group_product_quantities_warehouse_move_companies"/>
         </record>
 
         <record model="ir.model.access" id="access_product_quantities_warehouse_move">
diff --git a/shipment.xml b/shipment.xml
index 2962b88996..73fb7ec206 100644
--- a/shipment.xml
+++ b/shipment.xml
@@ -992,60 +992,64 @@ this repository contains the full copyright notices and license terms. -->
             <field name="group" ref="group_stock"/>
         </record>
 
-        <record model="ir.rule.group" id="rule_group_shipment_in">
-            <field name="name">User in company</field>
+        <record model="ir.rule.group" id="rule_group_shipment_in_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.shipment.in')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_shipment_in">
+        <record model="ir.rule" id="rule_shipment_in_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_shipment_in"/>
+            <field name="rule_group" ref="rule_group_shipment_in_companies"/>
         </record>
-        <record model="ir.rule.group" id="rule_group_shipment_in_return">
-            <field name="name">User in company</field>
+
+        <record model="ir.rule.group" id="rule_group_shipment_in_return_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.shipment.in.return')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_shipment_in_return">
+        <record model="ir.rule" id="rule_shipment_in_return_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_shipment_in_return"/>
+            <field name="rule_group" ref="rule_group_shipment_in_return_companies"/>
         </record>
-        <record model="ir.rule.group" id="rule_group_shipment_out">
-            <field name="name">User in company</field>
+
+        <record model="ir.rule.group" id="rule_group_shipment_out_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.shipment.out')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_shipment_out">
+        <record model="ir.rule" id="rule_shipment_out_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_shipment_out"/>
+            <field name="rule_group" ref="rule_group_shipment_out_companies"/>
         </record>
-        <record model="ir.rule.group" id="rule_group_shipment_out_return">
-            <field name="name">User in company</field>
+
+        <record model="ir.rule.group" id="rule_group_shipment_out_return_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.shipment.out.return')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_shipment_out_return">
+        <record model="ir.rule" id="rule_shipment_out_return_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_shipment_out_return"/>
+            <field name="rule_group" ref="rule_group_shipment_out_return_companies"/>
         </record>
-        <record model="ir.rule.group" id="rule_group_shipment_internal">
-            <field name="name">User in company</field>
+
+        <record model="ir.rule.group" id="rule_group_shipment_internal_companies">
+            <field name="name">User in companies</field>
             <field name="model" search="[('model', '=', 'stock.shipment.internal')]"/>
             <field name="global_p" eval="True"/>
         </record>
-        <record model="ir.rule" id="rule_shipment_internal">
+        <record model="ir.rule" id="rule_shipment_internal_companies">
             <field name="domain"
-                eval="[('company', '=', Eval('user', {}).get('company', None))]"
+                eval="[('company', 'in', Eval('companies', []))]"
                 pyson="1"/>
-            <field name="rule_group" ref="rule_group_shipment_internal"/>
+            <field name="rule_group" ref="rule_group_shipment_internal_companies"/>
         </record>
 
         <record model="ir.ui.view" id="shipment_assign_partial_view_form">
diff --git a/stock_reporting_margin.xml b/stock_reporting_margin.xml
index f76a3b48bb..41ea402889 100644
--- a/stock_reporting_margin.xml
+++ b/stock_reporting_margin.xml
@@ -77,6 +77,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_margin_product"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_margin_product_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'stock.reporting.margin.product')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_margin_product_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_margin_product_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_margin_product">
             <field name="model" search="[('model', '=', 'stock.reporting.margin.product')]"/>
             <field name="perm_read" eval="False"/>
@@ -153,6 +165,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_margin_product_time_series"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_margin_product_time_series_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'stock.reporting.margin.product.time_series')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_margin_product_time_series_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_margin_product_time_series_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_margin_product_time_series">
             <field name="model" search="[('model', '=', 'stock.reporting.margin.product.time_series')]"/>
             <field name="perm_read" eval="False"/>
@@ -270,6 +294,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_margin_category"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_margin_category_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'stock.reporting.margin.category')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_margin_category_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_margin_category_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_margin_category">
             <field name="model" search="[('model', '=', 'stock.reporting.margin.category')]"/>
             <field name="perm_read" eval="False"/>
@@ -346,6 +382,18 @@ this repository contains the full copyright notices and license terms. -->
             <field name="action" ref="act_reporting_margin_category_time_series"/>
         </record>
 
+        <record model="ir.rule.group" id="rule_group_reporting_margin_category_time_series_companies">
+            <field name="name">User in companies</field>
+            <field name="model" search="[('model', '=', 'stock.reporting.margin.category.time_series')]"/>
+            <field name="global_p" eval="True"/>
+        </record>
+        <record model="ir.rule" id="rule_reporting_margin_category_time_series_companies">
+            <field name="domain"
+                eval="[('company', 'in', Eval('companies', []))]"
+                pyson="1"/>
+            <field name="rule_group" ref="rule_group_reporting_margin_category_time_series_companies"/>
+        </record>
+
         <record model="ir.model.access" id="access_reporting_margin_category_time_series">
             <field name="model" search="[('model', '=', 'stock.reporting.margin.category.time_series')]"/>
             <field name="perm_read" eval="False"/>
diff --git a/tests/test_stock.py b/tests/test_stock.py
index 18a2826e19..23d58f523c 100644
--- a/tests/test_stock.py
+++ b/tests/test_stock.py
@@ -17,13 +17,11 @@ from trytond.exceptions import UserWarning, UserError
 from trytond.pool import Pool
 
 from trytond.modules.company.tests import (
-    create_company, set_company, PartyCompanyCheckEraseMixin,
-    CompanyMultiValueTestMixin)
+    create_company, set_company, PartyCompanyCheckEraseMixin, CompanyTestMixin)
 
 
 class StockTestCase(
-        PartyCompanyCheckEraseMixin, CompanyMultiValueTestMixin,
-        ModuleTestCase):
+        PartyCompanyCheckEraseMixin, CompanyTestMixin, ModuleTestCase):
     'Test Stock module'
     module = 'stock'
     longMessage = True