[FIX] mail: restrict access to mail.mail model

From now on mail.mail is considered as a technical model. Indeed people should
not really manually craft mails by hand. Instead various functional flows
should either send mails, either craft mails based on some user input.

We therefore make mail restricted to admin users. Flows creating mail.mail
are updated to use sudo, and ensure it was done in a context that makes
sense to delegate this power to the user.

Task ID 1853147
PR #32243

1 files changed, 2 insertions, 2 deletions

diff --git a/addons/test_mail/tests/test_message_post.py b/addons/test_mail/tests/test_message_post.py
index 14a8e9e3628..bf894fafe12 100644
--- a/addons/test_mail/tests/test_message_post.py
+++ b/addons/test_mail/tests/test_message_post.py
@@ -86,7 +86,7 @@ class TestMessagePost(TestMailCommon, TestRecipients):
         self.assertEqual(msg.channel_ids, self.env['mail.channel'])
 
         # notifications emails should have been deleted
-        self.assertFalse(self.env['mail.mail'].search([('mail_message_id', '=', msg.id)]),
+        self.assertFalse(self.env['mail.mail'].sudo().search([('mail_message_id', '=', msg.id)]),
                          'message_post: mail.mail notifications should have been auto-deleted')
 
     @mute_logger('odoo.addons.mail.models.mail_mail')
@@ -101,7 +101,7 @@ class TestMessagePost(TestMailCommon, TestRecipients):
         )
 
         # notifications emails should not have been deleted: one for customers, one for user
-        self.assertEqual(len(self.env['mail.mail'].search([('mail_message_id', '=', msg.id)])), 2)
+        self.assertEqual(len(self.env['mail.mail'].sudo().search([('mail_message_id', '=', msg.id)])), 2)
 
     @mute_logger('odoo.addons.mail.models.mail_mail')
     def test_post_notifications_emails_tweak(self):