[FIX] calendar: accepting meeting invite from email

Behavior prior to the fix:

When accepting a meeting invite from the invitation email, if not logged
in, an Internal Server Error is received.  Additionally, if already
logged in, an Internal Server Error is also received (albeit for a
different reason)

Behavior after the fix:

Accepting (or declining) the meeting invite works and shows the
accepted/declined meeting.

opw-2366173

closes odoo/odoo#60556

Related: odoo/enterprise#14359
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>

3 files changed, 53 insertions, 5 deletions

diff --git a/addons/calendar/controllers/main.py b/addons/calendar/controllers/main.py
index f341483fed6..e68a5bab412 100644
--- a/addons/calendar/controllers/main.py
+++ b/addons/calendar/controllers/main.py
@@ -14,7 +14,7 @@ class CalendarController(http.Controller):
     # YTI Note: Keep id and kwargs only for retrocompatibility purpose
     @http.route('/calendar/meeting/accept', type='http', auth="calendar")
     def accept_meeting(self, token, id, **kwargs):
-        attendee = request.env['calendar.attendee'].search([
+        attendee = request.env['calendar.attendee'].sudo().search([
             ('access_token', '=', token),
             ('state', '!=', 'accepted')])
         attendee.do_accept()
@@ -36,7 +36,7 @@ class CalendarController(http.Controller):
 
     @http.route('/calendar/meeting/decline', type='http', auth="calendar")
     def decline_meeting(self, token, id, **kwargs):
-        attendee = request.env['calendar.attendee'].search([
+        attendee = request.env['calendar.attendee'].sudo().search([
             ('access_token', '=', token),
             ('state', '!=', 'declined')])
         attendee.do_decline()
@@ -58,19 +58,19 @@ class CalendarController(http.Controller):
 
     @http.route('/calendar/meeting/view', type='http', auth="calendar")
     def view_meeting(self, token, id, **kwargs):
-        attendee = request.env['calendar.attendee'].search([
+        attendee = request.env['calendar.attendee'].sudo().search([
             ('access_token', '=', token),
             ('event_id', '=', int(id))])
         if not attendee:
             return request.not_found()
         timezone = attendee.partner_id.tz
         lang = attendee.partner_id.lang or get_lang(request.env).code
-        event = request.env['calendar.event'].with_context(tz=timezone, lang=lang).browse(int(id))
+        event = request.env['calendar.event'].with_context(tz=timezone, lang=lang).sudo().browse(int(id))
 
         # If user is internal and logged, redirect to form view of event
         # otherwise, display the simplifyed web page with event informations
         if request.session.uid and request.env['res.users'].browse(request.session.uid).user_has_groups('base.group_user'):
-            return werkzeug.utils.redirect('/web?db=%s#id=%s&view_type=form&model=calendar.event' % (self.env.cr.dbname, id))
+            return werkzeug.utils.redirect('/web?db=%s#id=%s&view_type=form&model=calendar.event' % (request.env.cr.dbname, id))
 
         # NOTE : we don't use request.render() since:
         # - we need a template rendering which is not lazy, to render before cursor closing
diff --git a/addons/calendar/tests/__init__.py b/addons/calendar/tests/__init__.py
index 92af18366a9..e16500942a3 100644
--- a/addons/calendar/tests/__init__.py
+++ b/addons/calendar/tests/__init__.py
@@ -4,6 +4,7 @@
 from . import test_access_rights
 from . import test_attendees
 from . import test_calendar
+from . import test_calendar_controller
 from . import test_calendar_recurrent_event_case2
 from . import test_event_recurrence
 from . import test_event_notifications
diff --git a/addons/calendar/tests/test_calendar_controller.py b/addons/calendar/tests/test_calendar_controller.py
new file mode 100644
index 00000000000..32dc7abc77a
--- /dev/null
+++ b/addons/calendar/tests/test_calendar_controller.py
@@ -0,0 +1,47 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+from datetime import datetime
+
+from odoo.tests.common import HttpCase, new_test_user, tagged
+
+
+@tagged("post_install", "-at_install")
+class TestCalendarController(HttpCase):
+    def setUp(self):
+        super().setUp()
+        self.user = new_test_user(self.env, "test_user_1", email="test_user_1@nowhere.com", tz="UTC")
+        self.other_user = new_test_user(self.env, "test_user_2", email="test_user_2@nowhere.com", password="P@ssw0rd!", tz="UTC")
+        self.partner = self.user.partner_id
+        self.event = (
+            self.env["calendar.event"]
+            .create(
+                {
+                    "name": "Doom's day",
+                    "start": datetime(2019, 10, 25, 8, 0),
+                    "stop": datetime(2019, 10, 27, 18, 0),
+                    "partner_ids": [(4, self.partner.id)],
+                }
+            )
+            .with_context(mail_notrack=True)
+        )
+
+    def test_accept_meeting_unauthenticated(self):
+        self.event.write({"partner_ids": [(4, self.other_user.partner_id.id)]})
+        token = self.event.attendee_ids[1].access_token
+        url = "/calendar/meeting/accept?token=%s&id=%d" % (token, self.event.id)
+        res = self.url_open(url)
+
+        self.assertEqual(res.status_code, 200, "Response should = OK")
+        self.event.attendee_ids[1].invalidate_cache()
+        self.assertEqual(self.event.attendee_ids[1].state, "accepted", "Attendee should have accepted")
+
+    def test_accept_meeting_authenticated(self):
+        self.event.write({"partner_ids": [(4, self.other_user.partner_id.id)]})
+        token = self.event.attendee_ids[1].access_token
+        url = "/calendar/meeting/accept?token=%s&id=%d" % (token, self.event.id)
+        self.authenticate("test_user_2", "P@ssw0rd!")
+        res = self.url_open(url)
+
+        self.assertEqual(res.status_code, 200, "Response should = OK")
+        self.event.attendee_ids[1].invalidate_cache()
+        self.assertEqual(self.event.attendee_ids[1].state, "accepted", "Attendee should have accepted")