From cd1aef8dfc59b1d8a27b489eb33cf29bb8e3a6f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 21 Apr 2026 12:15:36 +0200
Subject: [PATCH] Check access only on entry points of chat channel

Since 317e5ff39097 the read access is restricted to the admin group.
The access right should not be enforced for the transaction but only at the RPC
entry point.

Closes #14791
(grafted from 8c311ddd3da49bdbd61f2ae22074880ea79ae2ec)

--HG--
branch : 8.0
---
 trytond/trytond/ir/chat.py | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/trytond/trytond/ir/chat.py b/trytond/trytond/ir/chat.py
index 08fd1cfa02..10afb4fdbe 100644
--- a/trytond/trytond/ir/chat.py
+++ b/trytond/trytond/ir/chat.py
@@ -22,7 +22,7 @@ from trytond.sendmail import send_message_transactional
 from trytond.tools import cached_property, firstline
 from trytond.tools.email_ import (
     EmailNotValidError, normalize_email, set_from_header, validate_email)
-from trytond.transaction import Transaction
+from trytond.transaction import Transaction, check_access
 from trytond.url import host
 
 FOLLOWER_SEARCH_LIMIT = 20
@@ -53,15 +53,15 @@ class Channel(ModelSQL, ModelView):
                 'ir.msg_chat_channel_identifier_unique'),
             ]
         cls.__rpc__.update(
-            subscribe=RPC(readonly=False),
-            unsubscribe=RPC(readonly=False),
-            subscribe_email=RPC(readonly=False),
-            unsubscribe_email=RPC(readonly=False),
-            get_followers=RPC(),
-            search_followers=RPC(),
-            post=RPC(readonly=False, result=int),
+            subscribe=RPC(readonly=False, check_access=False),
+            unsubscribe=RPC(readonly=False, check_access=False),
+            subscribe_email=RPC(readonly=False, check_access=False),
+            unsubscribe_email=RPC(readonly=False, check_access=False),
+            get_followers=RPC(check_access=False),
+            search_followers=RPC(check_access=False),
+            post=RPC(readonly=False, check_access=False, result=int),
             get_models=RPC(),
-            get=RPC(),
+            get=RPC(check_access=False),
             )
         cls._buttons.update({
                 'reset_identifier': {
@@ -98,6 +98,7 @@ class Channel(ModelSQL, ModelView):
         return self.resource.rec_name
 
     @classmethod
+    @check_access
     def check_access(cls, resource):
         pool = Pool()
         ModelAccess = pool.get('ir.model.access')
@@ -107,7 +108,6 @@ class Channel(ModelSQL, ModelView):
 
     @classmethod
     def _get_channel(cls, resource):
-        cls.check_access(resource)
         channels = cls.search([
                 ('resource', '=', str(resource)),
                 ])
@@ -144,12 +144,13 @@ class Channel(ModelSQL, ModelView):
 
     @classmethod
     def unsubscribe(cls, resource, username=None):
+        cls.check_access(resource)
+
         pool = Pool()
         Follower = pool.get('ir.chat.follower')
         User = pool.get('res.user')
 
         if username:
-            cls.check_access(resource)
             try:
                 user, = User.search([('login', '=', username)], limit=1)
             except ValueError:
@@ -226,6 +227,8 @@ class Channel(ModelSQL, ModelView):
 
     @classmethod
     def get_followers(cls, resource):
+        cls.check_access(resource)
+
         return sorted(
             cls._get_followers(resource).values(), key=itemgetter('name'))
 
@@ -246,6 +249,8 @@ class Channel(ModelSQL, ModelView):
 
     @classmethod
     def search_followers(cls, resource, text, limit=FOLLOWER_SEARCH_LIMIT):
+        cls.check_access(resource)
+
         potential_followers = cls._search_followers(resource, text)
         current_followers = cls.get_followers(resource)
 
@@ -256,6 +261,8 @@ class Channel(ModelSQL, ModelView):
 
     @classmethod
     def post(cls, resource, content, audience='internal'):
+        cls.check_access(resource)
+
         pool = Pool()
         Message = pool.get('ir.chat.message')
         User = pool.get('res.user')
@@ -373,9 +380,10 @@ class Channel(ModelSQL, ModelView):
 
     @classmethod
     def get(cls, resource, before=None, after=None):
+        cls.check_access(resource)
+
         pool = Pool()
         Message = pool.get('ir.chat.message')
-        cls.check_access(resource)
         domain = [
             ('channel.resource', '=', resource),
             ]