[FIX] mail: restrict access to mail.mail model

From now on mail.mail is considered as a technical model. Indeed people should
not really manually craft mails by hand. Instead various functional flows
should either send mails, either craft mails based on some user input.

We therefore make mail restricted to admin users. Flows creating mail.mail
are updated to use sudo, and ensure it was done in a context that makes
sense to delegate this power to the user.

Task ID 1853147
PR #32243

6 files changed, 10 insertions, 11 deletions

diff --git a/addons/test_mail/tests/test_ir_actions.py b/addons/test_mail/tests/test_ir_actions.py
index 6a547081a15..d67124b2153 100644
--- a/addons/test_mail/tests/test_ir_actions.py
+++ b/addons/test_mail/tests/test_ir_actions.py
@@ -12,7 +12,7 @@ class TestServerActionsEmail(TestMailCommon, TestServerActionsBase):
         self.action.write({'state': 'email', 'template_id': email_template.id})
         self.action.with_context(self.context).run()
         # check an email is waiting for sending
-        mail = self.env['mail.mail'].search([('subject', '=', 'About TestingPartner')])
+        mail = self.env['mail.mail'].sudo().search([('subject', '=', 'About TestingPartner')])
         self.assertEqual(len(mail), 1)
         # check email content
         self.assertEqual(mail.body, '<p>Hello TestingPartner</p>')
diff --git a/addons/test_mail/tests/test_mail_mail.py b/addons/test_mail/tests/test_mail_mail.py
index 7fb29598e6f..7e6b0f98ba2 100644
--- a/addons/test_mail/tests/test_mail_mail.py
+++ b/addons/test_mail/tests/test_mail_mail.py
@@ -15,8 +15,7 @@ class TestMailMail(TestMailCommon):
     @mute_logger('odoo.addons.mail.models.mail_mail')
     def test_mail_message_notify_from_mail_mail(self):
         # Due ot post-commit hooks, store send emails in every step
-        # self.email_to_list = []
-        mail = self.env['mail.mail'].create({
+        mail = self.env['mail.mail'].sudo().create({
             'body_html': '<p>Test</p>',
             'email_to': 'test@example.com',
             'partner_ids': [(4, self.user_employee.partner_id.id)]
@@ -28,7 +27,7 @@ class TestMailMail(TestMailCommon):
 
     @mute_logger('odoo.addons.mail.models.mail_mail')
     def test_mail_message_values_unicode(self):
-        mail = self.env['mail.mail'].create({
+        mail = self.env['mail.mail'].sudo().create({
             'body_html': '<p>Test</p>',
             'email_to': 'test.😊@example.com',
             'partner_ids': [(4, self.user_employee.partner_id.id)]
@@ -45,7 +44,7 @@ class TestMailMailRace(common.TransactionCase):
             'name': 'Ernest Partner',
         })
         # we need to simulate a mail sent by the cron task, first create mail, message and notification by hand
-        mail = self.env['mail.mail'].create({
+        mail = self.env['mail.mail'].sudo().create({
             'body_html': '<p>Test</p>',
             'notification': True,
             'state': 'outgoing',
diff --git a/addons/test_mail/tests/test_mail_template.py b/addons/test_mail/tests/test_mail_template.py
index a6634ac34f8..a845ffc0a79 100644
--- a/addons/test_mail/tests/test_mail_template.py
+++ b/addons/test_mail/tests/test_mail_template.py
@@ -48,7 +48,7 @@ class TestMailTemplate(TestMailCommon, TestRecipients):
     @mute_logger('odoo.addons.mail.models.mail_mail')
     def test_template_send_email(self):
         mail_id = self.email_template.send_mail(self.test_record.id)
-        mail = self.env['mail.mail'].browse(mail_id)
+        mail = self.env['mail.mail'].sudo().browse(mail_id)
         self.assertEqual(mail.subject, 'About %s' % self.test_record.name)
         self.assertEqual(mail.email_to, self.email_template.email_to)
         self.assertEqual(mail.email_cc, self.email_template.email_cc)
diff --git a/addons/test_mail/tests/test_message_composer.py b/addons/test_mail/tests/test_message_composer.py
index 563f4390d9f..e94b5a533c3 100644
--- a/addons/test_mail/tests/test_message_composer.py
+++ b/addons/test_mail/tests/test_message_composer.py
@@ -72,7 +72,7 @@ class TestComposer(TestMailCommon, TestRecipients):
         }).send_mail()
 
         # check mail_mail
-        mails = self.env['mail.mail'].search([('subject', 'ilike', 'Testing')])
+        mails = self.env['mail.mail'].sudo().search([('subject', 'ilike', 'Testing')])
         for mail in mails:
             self.assertEqual(mail.recipient_ids, self.partner_1 | self.partner_2,
                              'compose wizard: mail_mail mass mailing: mail.mail in mass mail incorrect recipients')
diff --git a/addons/test_mail/tests/test_message_post.py b/addons/test_mail/tests/test_message_post.py
index 14a8e9e3628..bf894fafe12 100644
--- a/addons/test_mail/tests/test_message_post.py
+++ b/addons/test_mail/tests/test_message_post.py
@@ -86,7 +86,7 @@ class TestMessagePost(TestMailCommon, TestRecipients):
         self.assertEqual(msg.channel_ids, self.env['mail.channel'])
 
         # notifications emails should have been deleted
-        self.assertFalse(self.env['mail.mail'].search([('mail_message_id', '=', msg.id)]),
+        self.assertFalse(self.env['mail.mail'].sudo().search([('mail_message_id', '=', msg.id)]),
                          'message_post: mail.mail notifications should have been auto-deleted')
 
     @mute_logger('odoo.addons.mail.models.mail_mail')
@@ -101,7 +101,7 @@ class TestMessagePost(TestMailCommon, TestRecipients):
         )
 
         # notifications emails should not have been deleted: one for customers, one for user
-        self.assertEqual(len(self.env['mail.mail'].search([('mail_message_id', '=', msg.id)])), 2)
+        self.assertEqual(len(self.env['mail.mail'].sudo().search([('mail_message_id', '=', msg.id)])), 2)
 
     @mute_logger('odoo.addons.mail.models.mail_mail')
     def test_post_notifications_emails_tweak(self):
diff --git a/addons/test_mail/tests/test_performance.py b/addons/test_mail/tests/test_performance.py
index 00676a580d3..b7948c23a4b 100644
--- a/addons/test_mail/tests/test_performance.py
+++ b/addons/test_mail/tests/test_performance.py
@@ -459,8 +459,8 @@ class TestMailComplexPerformance(BaseMailPerformance):
             'recipient_ids': [(4, pid) for pid in self.partners.ids],
         })
         mail_ids = mail.ids
-        with self.assertQueryCount(__system__=8, emp=9):
-            self.env['mail.mail'].browse(mail_ids).send()
+        with self.assertQueryCount(__system__=8, emp=8):
+            self.env['mail.mail'].sudo().browse(mail_ids).send()
 
         self.assertEqual(mail.body_html, '<p>Test</p>')
         self.assertEqual(mail.reply_to, formataddr(('%s %s' % (self.env.company.name, self.umbrella.name), 'test-alias@example.com')))