[FIX] web: do no try to render filters referencing access restricted fields

In case a field is limited to specific groups on the model, those fields
are discarded from `fields_view_get()` but can still be referenced by some
filters on the search view causing a traceback (see #53797)

Model:

```python

class MyModel(models.Model):

  my_field = fields.Char(groups='base.group_system')
```

Search views:

```xml
<search string="My Model">
    <filter name="group_myfield" context="{'group_by': 'my_field'}"/>
</search>
```

This commit ensure those filter are correctly discarded.

OPW-2284621

closes odoo/odoo#54112

X-original-commit: b3452a1863c36290b13e16161e2703d9a3737f0e
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>

1 files changed, 43 insertions, 0 deletions

diff --git a/addons/web/static/tests/control_panel/control_panel_tests.js b/addons/web/static/tests/control_panel/control_panel_tests.js
index 84000e7c616..c2dce2eb16f 100644
--- a/addons/web/static/tests/control_panel/control_panel_tests.js
+++ b/addons/web/static/tests/control_panel/control_panel_tests.js
@@ -130,6 +130,49 @@ odoo.define('web.control_panel_tests', function (require) {
             controlPanel.destroy();
         });
 
+        QUnit.test('invisible fields and filters with unknown related fields should not be rendered', async function (assert) {
+            assert.expect(2);
+
+            // This test case considers that the current user is not a member of
+            // the "base.group_system" group and both "bar" and "date_field" fields
+            // have field-level access control that limit access to them only from
+            // that group.
+            //
+            // As MockServer currently does not support "groups" access control, we:
+            //
+            // - emulate field-level access control of fields_get() by removing
+            //   "bar" and "date_field" from the model fields
+            // - set filters with groups="base.group_system" as `invisible=1` in
+            //   view to emulate the behavior of fields_view_get()
+            //   [see ir.ui.view `_apply_group()`]
+
+            delete this.fields['bar'];
+            delete this.fields['date_field'];
+
+            const arch = `
+                <search>
+                    <field name="foo"/>
+                    <filter name="filterDate" string="Date" date="date_field" default_period="last_365_days" invisible="1" groups="base.group_system"/>
+                    <filter name="groupByBar" string="Bar" context="{'group_by': 'bar'}" invisible="1" groups="base.group_system"/>
+                </search>`;
+            const searchMenuTypes = [];
+            const params = {
+                cpStoreConfig: {
+                    viewInfo: { arch, fields: this.fields },
+                    searchMenuTypes
+                },
+                cpProps: { fields: this.fields, searchMenuTypes },
+            };
+            const controlPanel = await createControlPanel(params);
+
+            assert.containsNone(controlPanel.el, 'div.o_search_options div.o_filter_menu',
+                "there should not be filter dropdown");
+            assert.containsNone(controlPanel.el, 'div.o_search_options div.o_group_by_menu',
+                "there should not be groupby dropdown");
+
+            controlPanel.destroy();
+        });
+
         QUnit.test('groupby menu is not rendered if searchMenuTypes does not have groupBy', async function (assert) {
             assert.expect(2);