[FIX] osv: fix combination of unit domain

Combining a list of elements containing only the monoid's unit should return the
unit.

Since the unit is skipped, it would return an empty domain instead of the unit,
meaning that (0, '=', 1) could not be used in a group rule.

To test this, create a record rule on a model M with domain (0, '=', 1)
that applies to group G.
Log in with a user in group G and access model M; you can read everything
(provided no other record rule applies) whereas you should see nothing.

Because of expression.AND(global_domains + [expression.OR(group_domains)])
we want the empty domain to still be left untouched, even if it violates
the OR's unit rules (i.e. OR(empty, OR(R)) = OR(R) <=> OR(empty) = unit).
Meaning that no group rule would reduce to having a (0, '=' 1) group rule.
So in the end we don't really care about all that algebraic nonsense.

closes odoo/odoo#28765

2 files changed, 22 insertions, 0 deletions

diff --git a/odoo/addons/test_access_rights/tests/test_ir_rules.py b/odoo/addons/test_access_rights/tests/test_ir_rules.py
index c1ce6cc6b80..6724bdbf1e4 100644
--- a/odoo/addons/test_access_rights/tests/test_ir_rules.py
+++ b/odoo/addons/test_access_rights/tests/test_ir_rules.py
@@ -35,6 +35,26 @@ class TestRules(TransactionCase):
         with self.assertRaises(AccessError):
             self.assertEqual(browse2.val, -1)
 
+    def test_group_rule(self):
+        env = self.env(user=self.browse_ref('base.public_user'))
+
+        # we forbid access to the public group, to which the public user belongs
+        self.env['ir.rule'].create({
+            'name': 'Forbid public group',
+            'model_id': self.browse_ref('test_access_rights.model_test_access_right_some_obj').id,
+            'groups': [(6, 0, [self.browse_ref('base.group_public').id])],
+            'domain_force': "[(0, '=', 1)]"
+        })
+
+        browse2 = env['test_access_right.some_obj'].browse(self.id2)
+        browse1 = env['test_access_right.some_obj'].browse(self.id1)
+
+        # everything should blow up
+        with self.assertRaises(AccessError):
+            self.assertEqual(browse2.val, -1)
+        with self.assertRaises(AccessError):
+            self.assertEqual(browse1.val, 1)
+
     def test_many2many(self):
         """ Test assignment of many2many field where rules apply. """
         ids = [self.id1, self.id2]
diff --git a/odoo/osv/expression.py b/odoo/osv/expression.py
index 483f325322c..f5518fead94 100644
--- a/odoo/osv/expression.py
+++ b/odoo/osv/expression.py
@@ -251,6 +251,8 @@ def combine(operator, unit, zero, domains):
     """
     result = []
     count = 0
+    if domains == [unit]:
+        return unit
     for domain in domains:
         if domain == unit:
             continue