[FIX] point_of_sale: multi company opening session

When you are lanching a POS session in multi-company, the allowed
companies in the user context when you open the route '/pos/web' are the
ones taken from your cookies which are the last thicked in any of your
tab.

So if you have a tab in company one, then open a new one and thick
company 2, the values in your cookies will be company 2. The you go back
in tab 1 and open a POS, when you'll arrive in the main controller,
you'll have a company 2 in allowed companies even if you are opening a
session which is in company 1.

So we are searching in the session with a sudo, as there is only one
session/user, and then we pass the company of the session into the
allowed_companies in session user_context for the frontend.

closes odoo/odoo#35487

Signed-off-by: pimodoo <pimodoo@users.noreply.github.com>

2 files changed, 6 insertions, 3 deletions

diff --git a/addons/point_of_sale/controllers/main.py b/addons/point_of_sale/controllers/main.py
index 0fca1369384..9faece80e77 100644
--- a/addons/point_of_sale/controllers/main.py
+++ b/addons/point_of_sale/controllers/main.py
@@ -14,15 +14,18 @@ class PosController(http.Controller):
     @http.route('/pos/web', type='http', auth='user')
     def pos_web(self, **k):
         # if user not logged in, log him in
-        pos_sessions = request.env['pos.session'].search([
+        pos_sessions = request.env['pos.session'].sudo().search([
             ('state', '=', 'opened'),
             ('user_id', '=', request.session.uid),
             ('rescue', '=', False)])
         if not pos_sessions:
             return werkzeug.utils.redirect('/web#action=point_of_sale.action_client_pos_menu')
         pos_sessions.login()
+        # The POS only work in one company, so we enforce the one of the session in the context
+        session_info = request.env['ir.http'].session_info()
+        session_info['user_context']['allowed_company_ids'] = pos_sessions.company_id.ids
         context = {
-            'session_info': json.dumps(request.env['ir.http'].session_info())
+            'session_info': json.dumps(session_info)
         }
         return request.render('point_of_sale.index', qcontext=context)
 
diff --git a/addons/point_of_sale/static/src/js/models.js b/addons/point_of_sale/static/src/js/models.js
index 12fa88b6ddf..3192e7b714b 100644
--- a/addons/point_of_sale/static/src/js/models.js
+++ b/addons/point_of_sale/static/src/js/models.js
@@ -182,7 +182,7 @@ exports.PosModel = Backbone.Model.extend({
     },{
         model:  'res.company',
         fields: [ 'currency_id', 'email', 'website', 'company_registry', 'vat', 'name', 'phone', 'partner_id' , 'country_id', 'state_id', 'tax_calculation_rounding_method'],
-        ids:    function(self){ return [self.user.company_id[0]]; },
+        ids:    function(self){ return [session.user_context.allowed_company_ids[0]]; },
         loaded: function(self,companies){ self.company = companies[0]; },
     },{
         model:  'decimal.precision',