[FIX] web: report controller in multi-company

- Create 2 companies A & B
- Set a website on company A
- Switch to company B
- Open a done MO
- Open the cost analysis

An AccessError is displayed.

The error arises in:
https://github.com/odoo/enterprise/blob/923cbffe4e60572a5c17ee962d571c037e9cff44/mrp_account_enterprise/reports/mrp_cost_structure.py#L90

The root cause is coming from the call to `/report/html/`, which is
called without any `data`. In this situation, the following adds an
incorrect `allowed_company_ids` in the context:

https://github.com/odoo/odoo/blob/d1413a2f06bcb44b1fbb6dba8658e698c8da4018/addons/website/models/ir_http.py#L196-L205

Indeed, the `allowed_company_ids` is the one from the website, in this
case company A.

The issue doesn't occur when downloading a PDF from the interface since
in this case the `data` dictionary contains the appropriate context
which is set in:

https://github.com/odoo/odoo/blob/d1413a2f06bcb44b1fbb6dba8658e698c8da4018/addons/web/controllers/main.py#L1958

As a solution, we add the `user_context` in the `/report/html` route.

opw-2341747

closes odoo/odoo#59654

X-original-commit: 932e347a90bfd4bf025e4e8e54ef9c66cc49c5d0
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>

2 files changed, 68 insertions, 4 deletions

diff --git a/addons/web/static/src/js/chrome/action_manager_report.js b/addons/web/static/src/js/chrome/action_manager_report.js
index 61dbdbbcc96..b3c057969bd 100644
--- a/addons/web/static/src/js/chrome/action_manager_report.js
+++ b/addons/web/static/src/js/chrome/action_manager_report.js
@@ -189,6 +189,7 @@ ActionManager.include({
                     return value += activeIDsPath;
                 });
             }
+            reportUrls.html += '?context=' + encodeURIComponent(JSON.stringify(session.user_context));
         } else {
             var serializedOptionsPath = '?options=' + encodeURIComponent(JSON.stringify(action.data));
             serializedOptionsPath += '&context=' + encodeURIComponent(JSON.stringify(action.context));
diff --git a/addons/web/static/tests/chrome/action_manager_tests.js b/addons/web/static/tests/chrome/action_manager_tests.js
index d2c1e45e791..3bc111ac1ba 100644
--- a/addons/web/static/tests/chrome/action_manager_tests.js
+++ b/addons/web/static/tests/chrome/action_manager_tests.js
@@ -113,6 +113,12 @@ QUnit.module('ActionManager', {
             report_type: 'qweb-pdf',
             type: 'ir.actions.report',
             close_on_report_download: true,
+        }, {
+            id: 12,
+            name: "Some HTML Report",
+            report_name: 'some_report',
+            report_type: 'qweb-html',
+            type: 'ir.actions.report',
         }];
 
         this.archs = {
@@ -2262,7 +2268,7 @@ QUnit.module('ActionManager', {
                 if (route === '/report/check_wkhtmltopdf') {
                     return Promise.resolve('broken');
                 }
-                if (route === '/report/html/some_report') {
+                if (route.includes('/report/html/some_report')) {
                     return Promise.resolve();
                 }
                 return this._super.apply(this, arguments);
@@ -2284,7 +2290,64 @@ QUnit.module('ActionManager', {
             '/web/action/load',
             '/report/check_wkhtmltopdf',
             'warning',
-            '/report/html/some_report', // report client action's iframe
+            '/report/html/some_report?context=%7B%7D', // report client action's iframe
+        ]);
+
+        actionManager.destroy();
+        testUtils.mock.unpatch(ReportClientAction);
+    });
+
+    QUnit.test('send context in case of html report', async function (assert) {
+        assert.expect(4);
+
+        // patch the report client action to override its iframe's url so that
+        // it doesn't trigger an RPC when it is appended to the DOM (for this
+        // usecase, using removeSRCAttribute doesn't work as the RPC is
+        // triggered as soon as the iframe is in the DOM, even if its src
+        // attribute is removed right after)
+        testUtils.mock.patch(ReportClientAction, {
+            start: function () {
+                var self = this;
+                return this._super.apply(this, arguments).then(function () {
+                    self._rpc({route: self.iframe.getAttribute('src')});
+                    self.iframe.setAttribute('src', 'about:blank');
+                });
+            }
+        });
+
+        var actionManager = await createActionManager({
+            actions: this.actions,
+            archs: this.archs,
+            data: this.data,
+            services: {
+                report: ReportService,
+                notification: NotificationService.extend({
+                    notify: function (params) {
+                        assert.step(params.type || 'notification');
+                    }
+                })
+            },
+            mockRPC: function (route, args) {
+                assert.step(args.method || route);
+                if (route.includes('/report/html/some_report')) {
+                    return Promise.resolve();
+                }
+                return this._super.apply(this, arguments);
+            },
+            session: {
+                user_context: {
+                    some_key: 2,
+                }
+            },
+        });
+        await actionManager.doAction(12);
+
+        assert.containsOnce(actionManager, '.o_report_iframe',
+            "should have opened the report client action");
+
+        assert.verifySteps([
+            '/web/action/load',
+            '/report/html/some_report?context=%7B%22some_key%22%3A2%7D', // report client action's iframe
         ]);
 
         actionManager.destroy();
@@ -3492,7 +3555,7 @@ QUnit.module('ActionManager', {
         this.archs['partner,1,list'] = '<tree default_order="foo desc"><field name="foo"/></tree>';
 
         this.actions.push({
-            id: 12,
+            id: 100,
             name: 'Partners',
             res_model: 'partner',
             type: 'ir.actions.act_window',
@@ -3512,7 +3575,7 @@ QUnit.module('ActionManager', {
                 domain: '[("bar", "=", 1)]'
             }],
         });
-        await actionManager.doAction(12);
+        await actionManager.doAction(100);
 
         assert.strictEqual(actionManager.$('.o_list_view tr.o_data_row .o_data_cell').text(), 'zoupyopplopgnapblip',
             'record should be in descending order as default_order applies');