[REF] *: `record.env.user._is_XXX()` -> `record.env.is_XXX()`

Superuser mode implies `record.env.is_XXX()`.

10 files changed, 33 insertions, 19 deletions

diff --git a/odoo/addons/base/models/ir_actions_report.py b/odoo/addons/base/models/ir_actions_report.py
index 5f2d47be816..b3452b74fff 100644
--- a/odoo/addons/base/models/ir_actions_report.py
+++ b/odoo/addons/base/models/ir_actions_report.py
@@ -760,7 +760,7 @@ class IrActionsReport(models.Model):
         :param report_name: Name of the template to generate an action for
         """
         discard_logo_check = self.env.context.get('discard_logo_check')
-        if (self.env.user._is_admin()) and ((not self.env.company.external_report_layout_id) or (not discard_logo_check and not self.env.company.logo)) and config:
+        if self.env.is_admin() and ((not self.env.company.external_report_layout_id) or (not discard_logo_check and not self.env.company.logo)) and config:
             template = self.env.ref('base.view_company_report_form_with_print') if self.env.context.get('from_transient_model', False) else self.env.ref('base.view_company_report_form')
             return {
                 'name': _('Choose Your Document Layout'),
diff --git a/odoo/addons/base/models/ir_attachment.py b/odoo/addons/base/models/ir_attachment.py
index 3b314c7d849..f9f199ff0d0 100644
--- a/odoo/addons/base/models/ir_attachment.py
+++ b/odoo/addons/base/models/ir_attachment.py
@@ -10,7 +10,7 @@ import re
 from collections import defaultdict
 import uuid
 
-from odoo import api, fields, models, tools, SUPERUSER_ID, _
+from odoo import api, fields, models, tools, _
 from odoo.exceptions import AccessError, ValidationError, MissingError
 from odoo.tools import config, human_size, ustr, html_escape
 from odoo.tools.mimetypes import guess_mimetype
@@ -54,7 +54,7 @@ class IrAttachment(models.Model):
     @api.model
     def force_storage(self):
         """Force all attachments to be stored in the currently configured storage"""
-        if not self.env.user._is_admin():
+        if not self.env.is_admin():
             raise AccessError(_('Only administrators can execute this action.'))
 
         # domain to retrieve the attachments to migrate
@@ -314,7 +314,7 @@ class IrAttachment(models.Model):
         # ir.http's dispatch exception handling
         # XDO note: this should be done in check(write), constraints for access rights?
         # XDO note: if read on sudo, read twice, one for constraints, one for _inverse_datas as user
-        if self.env.user._is_admin():
+        if self.env.is_admin():
             return
         if self.type == 'binary' and self.url:
             has_group = self.env.user.has_group
@@ -327,7 +327,7 @@ class IrAttachment(models.Model):
         In the 'document' module, it is overriden to relax this hard rule, since
         more complex ones apply there.
         """
-        if self.env.user._is_superuser():
+        if self.env.is_superuser():
             return True
         # collect the records to check (by model)
         model_ids = defaultdict(set)            # {model_name: set(ids)}
@@ -335,7 +335,7 @@ class IrAttachment(models.Model):
         if self:
             self._cr.execute('SELECT res_model, res_id, create_uid, public, res_field FROM ir_attachment WHERE id IN %s', [tuple(self.ids)])
             for res_model, res_id, create_uid, public, res_field in self._cr.fetchall():
-                if not self.env.user._is_system() and res_field:
+                if not self.env.is_system() and res_field:
                     raise AccessError(_("Sorry, you are not allowed to access this document."))
                 if public and mode == 'read':
                     continue
@@ -369,7 +369,7 @@ class IrAttachment(models.Model):
             records.check_access_rule(mode)
 
         if require_employee:
-            if not (self.env.user._is_admin() or self.env.user.has_group('base.group_user')):
+            if not (self.env.is_admin() or self.env.user.has_group('base.group_user')):
                 raise AccessError(_("Sorry, you are not allowed to access this document."))
 
     def _read_group_allowed_fields(self):
@@ -387,7 +387,7 @@ class IrAttachment(models.Model):
         groupby = [groupby] if isinstance(groupby, str) else groupby
         allowed_fields = self._read_group_allowed_fields()
         fields_set = set(field.split(':')[0] for field in fields + groupby)
-        if not self.env.user._is_system() and (not fields or fields_set.difference(allowed_fields)):
+        if not self.env.is_system() and (not fields or fields_set.difference(allowed_fields)):
             raise AccessError(_("Sorry, you are not allowed to access these fields on attachments."))
         return super().read_group(domain, fields, groupby, offset=offset, limit=limit, orderby=orderby, lazy=lazy)
 
@@ -401,7 +401,7 @@ class IrAttachment(models.Model):
         ids = super(IrAttachment, self)._search(args, offset=offset, limit=limit, order=order,
                                                 count=False, access_rights_uid=access_rights_uid)
 
-        if self.env.user._is_system():
+        if self.env.is_system():
             # rules do not apply for the superuser
             return len(ids) if count else ids
 
diff --git a/odoo/addons/base/models/ir_autovacuum.py b/odoo/addons/base/models/ir_autovacuum.py
index 4e47730fe8f..6b57ed1523f 100644
--- a/odoo/addons/base/models/ir_autovacuum.py
+++ b/odoo/addons/base/models/ir_autovacuum.py
@@ -38,7 +38,7 @@ class AutoVacuum(models.AbstractModel):
 
     @api.model
     def power_on(self, *args, **kwargs):
-        if not self.env.user._is_admin():
+        if not self.env.is_admin():
             raise AccessDenied()
         self.env['ir.attachment']._file_gc()
         self._gc_transient_models()
diff --git a/odoo/addons/base/models/ir_model.py b/odoo/addons/base/models/ir_model.py
index 1217a4d2cbb..3af27a7ba0a 100644
--- a/odoo/addons/base/models/ir_model.py
+++ b/odoo/addons/base/models/ir_model.py
@@ -988,7 +988,7 @@ class IrModelConstraint(models.Model):
         """
         Delete PostgreSQL foreign keys and constraints tracked by this model.
         """
-        if not (self.env.su or self.env.user.has_group('base.group_system')):
+        if not self.env.is_system():
             raise AccessError(_('Administrator access is required to uninstall a module'))
 
         ids_set = set(self.ids)
@@ -1101,7 +1101,7 @@ class IrModelRelation(models.Model):
         """
         Delete PostgreSQL many2many relations tracked by this model.
         """
-        if not (self.env.su or self.env.user.has_group('base.group_system')):
+        if not self.env.is_system():
             raise AccessError(_('Administrator access is required to uninstall a module'))
 
         ids_set = set(self.ids)
@@ -1566,7 +1566,7 @@ class IrModelData(models.Model):
         the chance of gracefully deleting all records.
         This step is performed as part of the full uninstallation of a module.
         """
-        if not (self.env.su or self.env.user.has_group('base.group_system')):
+        if not self.env.is_system():
             raise AccessError(_('Administrator access is required to uninstall a module'))
 
         # enable model/field deletion
diff --git a/odoo/addons/base/models/ir_module.py b/odoo/addons/base/models/ir_module.py
index 5aa54e36973..700e44aa163 100644
--- a/odoo/addons/base/models/ir_module.py
+++ b/odoo/addons/base/models/ir_module.py
@@ -64,7 +64,7 @@ def assert_log_admin_access(method):
         user = self.env.user
         origin = request.httprequest.remote_addr if request else 'n/a'
         log_data = (method.__name__, self.sudo().mapped('name'), user.login, user.id, origin)
-        if not self.env.user._is_admin():
+        if not self.env.is_admin():
             _logger.warning('DENY access to module.%s on %s to user %s ID #%s via %s', *log_data)
             raise AccessDenied()
         _logger.info('ALLOW access to module.%s on %s to user %s #%s via %s', *log_data)
diff --git a/odoo/addons/base/models/ir_translation.py b/odoo/addons/base/models/ir_translation.py
index 39fc49e966e..373e5f5e8b0 100644
--- a/odoo/addons/base/models/ir_translation.py
+++ b/odoo/addons/base/models/ir_translation.py
@@ -514,7 +514,7 @@ class IrTranslation(models.Model):
         """ Check access rights of operation ``mode`` on ``self`` for the
         current user. Raise an AccessError in case conditions are not met.
         """
-        if self.env.user._is_superuser():
+        if self.env.is_superuser():
             return
 
         # collect translated field records (model_ids) and other translations
diff --git a/odoo/addons/base/models/res_config.py b/odoo/addons/base/models/res_config.py
index 4572d2a2ba1..e5b584a5768 100644
--- a/odoo/addons/base/models/res_config.py
+++ b/odoo/addons/base/models/res_config.py
@@ -612,7 +612,7 @@ class ResConfigSettings(models.TransientModel, ResConfigModuleInstallationMixin)
     @api.multi
     def execute(self):
         self.ensure_one()
-        if not self.env.user._is_admin() and not self.env.user.has_group('base.group_system'):
+        if not self.env.is_admin():
             raise AccessError(_("Only administrators can change the settings"))
 
         self = self.with_context(active_test=False)
diff --git a/odoo/addons/base/wizard/base_partner_merge.py b/odoo/addons/base/wizard/base_partner_merge.py
index ceb941eca24..058fd8732d5 100644
--- a/odoo/addons/base/wizard/base_partner_merge.py
+++ b/odoo/addons/base/wizard/base_partner_merge.py
@@ -267,7 +267,7 @@ class MergePartnerAutomatic(models.TransientModel):
             :param extra_checks: pass False to bypass extra sanity check (e.g. email address)
         """
         # super-admin can be used to bypass extra checks
-        if self.env.user._is_admin():
+        if self.env.is_admin():
             extra_checks = False
 
         Partner = self.env['res.partner']
diff --git a/odoo/api.py b/odoo/api.py
index e0358bba202..a08a12e297a 100644
--- a/odoo/api.py
+++ b/odoo/api.py
@@ -855,6 +855,20 @@ class Environment(Mapping):
         """ return the record corresponding to the given ``xml_id`` """
         return self['ir.model.data'].xmlid_to_object(xml_id, raise_if_not_found=raise_if_not_found)
 
+    def is_superuser(self):
+        """ Return whether the environment is in superuser mode. """
+        return self.su
+
+    def is_admin(self):
+        """ Return whether the current user has group "Access Rights", or is in
+            superuser mode. """
+        return self.su or self.user._is_admin()
+
+    def is_system(self):
+        """ Return whether the current user has group "Settings", or is in
+            superuser mode. """
+        return self.su or self.user._is_system()
+
     @property
     def user(self):
         """ return the current user (as an instance) """
diff --git a/odoo/fields.py b/odoo/fields.py
index 5a146f6664d..02d1e3ea21b 100644
--- a/odoo/fields.py
+++ b/odoo/fields.py
@@ -1124,7 +1124,7 @@ class Field(MetaField('DummyField', (object,), {})):
     def determine_draft_value(self, record):
         """ Determine the value of ``self`` for the given draft ``record``. """
         if self.compute:
-            if self.compute_sudo and record.env.uid != SUPERUSER_ID:
+            if self.compute_sudo and not record.env.su:
                 record_sudo = record.sudo()
                 copy_cache(record, record_sudo.env)
                 self.compute_value(record_sudo)
@@ -1824,7 +1824,7 @@ class Binary(Field):
             decoded_value = base64.b64decode(value)
             # Full mimetype detection
             if (guess_mimetype(decoded_value).startswith('image/svg') and
-                    not record.env.user._is_system()):
+                    not record.env.is_system()):
                 raise UserError(_("Only admins can upload SVG files."))
         if isinstance(value, bytes):
             return psycopg2.Binary(value)