[MERGE] forward port branch saas-12.4 up to f26de445e55

3 files changed, 47 insertions, 4 deletions

diff --git a/odoo/addons/test_access_rights/ir.model.access.csv b/odoo/addons/test_access_rights/ir.model.access.csv
index 20310a5d0da..9edd8503b72 100644
--- a/odoo/addons/test_access_rights/ir.model.access.csv
+++ b/odoo/addons/test_access_rights/ir.model.access.csv
@@ -2,3 +2,4 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_test_access_right_some_obj,access_test_access_right_some_obj,model_test_access_right_some_obj,,1,1,1,1
 access_test_access_right_container,access_test_access_right_container,model_test_access_right_container,,1,1,1,1
 access_test_access_right_parent,access_test_access_right_parent,model_test_access_right_parent,,1,1,1,1
+access_test_access_right_obj_categ,access_test_access_right_obj_categ,model_test_access_right_obj_categ,,1,1,1,1
diff --git a/odoo/addons/test_access_rights/models.py b/odoo/addons/test_access_rights/models.py
index 4dd8c034bac..bef14bad2c2 100644
--- a/odoo/addons/test_access_rights/models.py
+++ b/odoo/addons/test_access_rights/models.py
@@ -8,6 +8,7 @@ class SomeObj(models.Model):
     _description = 'Object For Test Access Right'
 
     val = fields.Integer()
+    categ_id = fields.Many2one('test_access_right.obj_categ')
     company_id = fields.Many2one('res.company')
     forbidden = fields.Integer(
         groups='test_access_rights.test_group,!base.group_no_one,base.group_user,!base.group_public',
@@ -28,3 +29,14 @@ class Parent(models.Model):
     _inherits = {'test_access_right.some_obj': 'obj_id'}
 
     obj_id = fields.Many2one('test_access_right.some_obj', required=True, ondelete='restrict')
+
+class ObjCateg(models.Model):
+    _name = 'test_access_right.obj_categ'
+    _description = "Context dependent searchable model"
+
+    name = fields.Char(required=True)
+
+    def search(self, args, **kwargs):
+        if self.env.context.get('only_media'):
+            args += [('name', '=', 'Media')]
+        return super(ObjCateg, self).search(args, **kwargs)
diff --git a/odoo/addons/test_access_rights/tests/test_ir_rules.py b/odoo/addons/test_access_rights/tests/test_ir_rules.py
index 79946d0c5a5..11447476070 100644
--- a/odoo/addons/test_access_rights/tests/test_ir_rules.py
+++ b/odoo/addons/test_access_rights/tests/test_ir_rules.py
@@ -8,10 +8,11 @@ class TestRules(TransactionCase):
     def setUp(self):
         super(TestRules, self).setUp()
 
-        self.id1 = self.env['test_access_right.some_obj']\
-            .create({'val': 1}).id
-        self.id2 = self.env['test_access_right.some_obj']\
-            .create({'val': -1}).id
+        ObjCateg = self.env['test_access_right.obj_categ']
+        SomeObj = self.env['test_access_right.some_obj']
+        self.categ1 = ObjCateg.create({'name': 'Food'}).id
+        self.id1 = SomeObj.create({'val': 1, 'categ_id': self.categ1}).id
+        self.id2 = SomeObj.create({'val': -1, 'categ_id': self.categ1}).id
         # create a global rule forbidding access to records with a negative
         # (or zero) val
         self.env['ir.rule'].create({
@@ -19,6 +20,13 @@ class TestRules(TransactionCase):
             'model_id': self.browse_ref('test_access_rights.model_test_access_right_some_obj').id,
             'domain_force': "[('val', '>', 0)]"
         })
+        # create a global rule that forbid access to records without
+        # categories, the search is part of the test
+        self.env['ir.rule'].create({
+            'name': 'See all categories',
+            'model_id': self.browse_ref('test_access_rights.model_test_access_right_some_obj').id,
+            'domain_force': "[('categ_id', 'in', user.env['test_access_right.obj_categ'].search([]).ids)]"
+        })
 
     def test_basic_access(self):
         env = self.env(user=self.browse_ref('base.public_user'))
@@ -89,3 +97,25 @@ class TestRules(TransactionCase):
         Model = env['test_access_right.some_obj']
         with self.assertQueryCount(0):
             Model._filter_access_rules('read')
+
+    def test_no_context_in_ir_rules(self):
+        """ The context should not impact the ir rules. """
+        env = self.env(user=self.browse_ref('base.public_user'))
+        ObjCateg = self.env['test_access_right.obj_categ']
+        SomeObj = self.env['test_access_right.some_obj']
+
+        # validate the effect of context on category search, there are
+        # no existing media category
+        self.assertTrue(ObjCateg.search([]))
+        self.assertFalse(ObjCateg.with_context(only_media=True).search([]))
+
+        # record1 is food and is accessible with an empy context
+        ObjCateg.clear_caches()
+        records = SomeObj.search([('id', '=', self.id1)])
+        self.assertTrue(records)
+
+        # it should also be accessible as the context is not used when
+        # searching for SomeObjs
+        ObjCateg.clear_caches()
+        records = SomeObj.with_context(only_media=True).search([('id', '=', self.id1)])
+        self.assertTrue(records)