[REF] website_slides: improve and make access options clearer

Purpose is to ensure more advanced use cases are still supported in new
elearning platform in addition to more public use cases. Fields controlling
access are now

 * enroll: who can enroll on course: public (everyone, simply click on join
   button), invite (added by already members) and payment (in bridge with
   website_sale, if SO with product is confirmed);
 * enroll_group_ids: automatically add members of those groups to the channel
   to ease having groups for a given subset of users;
 * visibility: who can see a channel and its slides: public (everyone, it means
   channel is visible on website for example), members (hidden for non members)
 * website_published on channels and slides; non publishers cannot see what
   is not published, whatever other parameters;
 * upload_group_ids: who can upload on a channel;
 * download_security on a slide is completely removed as it makes no sense
   for most slide types;

To ensure a better user experience responsible of a channel is added in its
members. People uploading a slide are now also allowed to read it to avoid
having inconsistency behavior between upload_group_ids and access rules.

Some tests are added.

This commit is linked to task ID 1942836 and PR #31239.

Co-Authored-By: Aurélien Warnon <awa@odoo.com>
Co-Authored-By: Thibault Delavallée <tde@odoo.com>

1 files changed, 9 insertions, 9 deletions

diff --git a/addons/website_slides/security/website_slides_security.xml b/addons/website_slides/security/website_slides_security.xml
index d3b54d240a1..e5ab59748d0 100644
--- a/addons/website_slides/security/website_slides_security.xml
+++ b/addons/website_slides/security/website_slides_security.xml
@@ -3,18 +3,17 @@
     <data noupdate="0">
         <!-- CHANNEL -->
         <record id="rule_slide_channel_global" model="ir.rule">
-            <field name="name">Channel: always visible</field>
+            <field name="name">Channel: always visible (sub rules exist)</field>
             <field name="model_id" ref="model_slide_channel"/>
             <field name="global" eval="True"/>
-            <field name="groups" eval="[(5, 0)]"/>
             <field name="domain_force">[(1, '=', 1)]</field>
         </record>
 
         <record id="rule_slide_channel_not_website" model="ir.rule">
-            <field name="name">Channel: public/portal/user: restricted to published only</field>
+            <field name="name">Channel: public/portal/user: restricted to published and visible or member only</field>
             <field name="model_id" ref="model_slide_channel"/>
             <field name="groups" eval="[(4, ref('base.group_public')), (4, ref('base.group_portal')), (4, ref('base.group_user'))]"/>
-            <field name="domain_force">[('website_published', '=', True)]</field>
+            <field name="domain_force">['&amp;', ('website_published', '=', True), '|', ('visibility', '=', 'public'), ('partner_ids', '=', user.partner_id.id)]</field>
         </record>
 
         <record id="rule_slide_channel_website" model="ir.rule">
@@ -26,20 +25,21 @@
 
         <!-- SLIDE -->
         <record id="rule_slide_slide_global" model="ir.rule">
-            <field name="name">Slide: always visible REMOVE ME</field>
+            <field name="name">Slide: always visible (sub rules exist)</field>
             <field name="model_id" ref="model_slide_slide"/>
             <field name="global" eval="True"/>
-            <field name="groups" eval="[(5, 0)]"/>
             <field name="domain_force">[(1, '=', 1)]</field>
         </record>
 
         <record id="rule_slide_slide_not_website" model="ir.rule">
-            <field name="name">Slide: public/portal/user: restricted to published, and either channel member or previewable</field>
+            <field name="name">Slide: public/portal/user: restricted to published or uploaded by user, and either channel member or public channel &amp; previewable</field>
             <field name="model_id" ref="model_slide_slide"/>
             <field name="groups" eval="[(4, ref('base.group_public')), (4, ref('base.group_portal')), (4, ref('base.group_user'))]"/>
             <field name="domain_force">['&amp;',
-    '|', ('is_preview', '=', True), ('channel_id.partner_ids', '=', user.partner_id.id),
-    '&amp;', ('channel_id.website_published', '=', True), ('website_published', '=', True)]</field>
+    '|',
+        '&amp;', ('channel_id.visibility', '=', 'public'), ('is_preview', '=', True),
+        ('channel_id.partner_ids', '=', user.partner_id.id),
+    '&amp;', ('channel_id.website_published', '=', True), '|', ('user_id', '=', user.id), ('website_published', '=', True)]</field>
         </record>
 
         <record id="rule_slide_slide_website" model="ir.rule">