[FIX] account*, sale*, website_event, portal: public user not necessarily in right company

Have the main company (A) with the public user
Have an invoice in company B

Make a brand new browser access the invoice with the token

Before this commit: the token link ended up asking the customer to login,
eventhough it wouldn't if the invoice were in company A

After this commit: the whole payment with access token flow works as expected.

OPW 1879999
closes #26744

8 files changed, 9 insertions, 9 deletions

diff --git a/addons/account/controllers/mail.py b/addons/account/controllers/mail.py
index 564856b909c..71c06faa44d 100644
--- a/addons/account/controllers/mail.py
+++ b/addons/account/controllers/mail.py
@@ -24,7 +24,7 @@ class MailController(MailController):
             except AccessError:
                 if record_sudo.access_token and consteq(record_sudo.access_token, access_token):
                     record_action = record_sudo.with_context(
-                        force_website=True).get_access_action(uid)
+                        force_website=True).get_access_action()
                     if record_action['type'] == 'ir.actions.act_url':
                         return werkzeug.utils.redirect(record_action['url'])
         return super(MailController, cls)._redirect_to_record(model, res_id, access_token=access_token)
diff --git a/addons/account_payment/controllers/payment.py b/addons/account_payment/controllers/payment.py
index 5d6ab903cb2..d34d29266c9 100644
--- a/addons/account_payment/controllers/payment.py
+++ b/addons/account_payment/controllers/payment.py
@@ -27,7 +27,7 @@ class PaymentPortal(http.Controller):
         except:
             return False
 
-        if request.env.user == request.env.ref('base.public_user'):
+        if request.env.user._is_public():
             save_token = False # we avoid to create a token for the public user
 
         token = request.env['payment.token'].sudo()  # currently no support of payment tokens
diff --git a/addons/account_payment/controllers/portal.py b/addons/account_payment/controllers/portal.py
index 28bca2a12a8..c5b86c47250 100644
--- a/addons/account_payment/controllers/portal.py
+++ b/addons/account_payment/controllers/portal.py
@@ -11,7 +11,7 @@ class PortalAccount(PortalAccount):
         values = super(PortalAccount, self)._invoice_get_page_view_values(invoice, access_token, **kwargs)
         payment_inputs = request.env['payment.acquirer']._get_available_payment_input(company=invoice.company_id)
         # if not connected (using public user), the method _get_available_payment_input will return public user tokens
-        is_public_user = request.env.ref('base.public_user') == request.env.user
+        is_public_user = request.env.user._is_public()
         if is_public_user:
             # we should not display payment tokens owned by the public user
             payment_inputs.pop('pms', None)
diff --git a/addons/portal/controllers/mail.py b/addons/portal/controllers/mail.py
index 89dbded3676..1abf05b4e63 100644
--- a/addons/portal/controllers/mail.py
+++ b/addons/portal/controllers/mail.py
@@ -37,7 +37,7 @@ def _message_post_helper(res_model='', res_id=None, message='', token='', nosubs
         access_as_sudo = _has_token_access(res_model, res_id, token=token)
         if access_as_sudo:
             record = record.sudo()
-            if request.env.user == request.env.ref('base.public_user'):
+            if request.env.user._is_public():
                 author_id = record.partner_id.id if hasattr(record, 'partner_id') else author_id
             else:
                 if not author_id:
diff --git a/addons/sale/controllers/mail.py b/addons/sale/controllers/mail.py
index d257bfa2736..6b82146d400 100644
--- a/addons/sale/controllers/mail.py
+++ b/addons/sale/controllers/mail.py
@@ -24,7 +24,7 @@ class MailController(MailController):
             except AccessError:
                 if record_sudo.access_token and consteq(record_sudo.access_token, access_token):
                     record_action = record_sudo.with_context(
-                        force_website=True).get_access_action(uid)
+                        force_website=True).get_access_action()
                     if record_action['type'] == 'ir.actions.act_url':
                         return werkzeug.utils.redirect(record_action['url'])
         return super(MailController, cls)._redirect_to_record(model, res_id, access_token=access_token)
diff --git a/addons/sale_payment/controllers/payment.py b/addons/sale_payment/controllers/payment.py
index db94060df40..585399c63d8 100644
--- a/addons/sale_payment/controllers/payment.py
+++ b/addons/sale_payment/controllers/payment.py
@@ -30,7 +30,7 @@ class PaymentPortal(http.Controller):
         # we check if the order need to create a payment token
         save_token = save_token or order_sudo._get_payment_type() == "form_save"
 
-        if request.env.user == request.env.ref('base.public_user'):
+        if request.env.user._is_public():
             save_token = False
 
         token = request.env['payment.token'].sudo()  # currently no support of payment tokens
@@ -74,7 +74,7 @@ class PaymentPortal(http.Controller):
         except (ValueError, TypeError):
             token = False
 
-        token_owner = order_sudo.partner_id if request.env.user == request.env.ref('base.public_user') else request.env.user.partner_id
+        token_owner = order_sudo.partner_id if request.env.user._is_public() else request.env.user.partner_id
         if not token or token.partner_id != token_owner:
             params['error'] = 'pay_sale_invalid_token'
             return request.redirect(_build_url_w_params(error_url, params))
diff --git a/addons/sale_payment/controllers/portal.py b/addons/sale_payment/controllers/portal.py
index 9b554c19c34..14a44786f44 100644
--- a/addons/sale_payment/controllers/portal.py
+++ b/addons/sale_payment/controllers/portal.py
@@ -12,7 +12,7 @@ class CustomerPortal(CustomerPortal):
         if values['portal_confirmation'] == 'pay':
             payment_inputs = request.env['payment.acquirer']._get_available_payment_input(order.partner_id, order.company_id)
             # if not connected (using public user), the method _get_available_payment_input will return public user tokens
-            is_public_user = request.env.ref('base.public_user') == request.env.user
+            is_public_user = request.env.user._is_public()
             if is_public_user:
                 # we should not display payment tokens owned by the public user
                 payment_inputs.pop('pms', None)
diff --git a/addons/website_event/models/event.py b/addons/website_event/models/event.py
index a69682712a3..846352f90b8 100644
--- a/addons/website_event/models/event.py
+++ b/addons/website_event/models/event.py
@@ -28,7 +28,7 @@ class Event(models.Model):
 
     def _compute_is_participating(self):
         # we don't allow public user to see participating label
-        if self.env.user != self.env.ref('base.public_user'):
+        if not self.env.user._is_public():
             email = self.env.user.partner_id.email
             for event in self:
                 domain = ['&', '|', ('email', '=', email), ('partner_id', '=', self.env.user.partner_id.id), ('event_id', '=', event.id)]