[FIX] models.py: Fix check_company mechanism

Purpose
=======

If check company is set on a field and if the user has no access
right to the field value (example: address_id on an expense sheet
could be set to a private res.partner, on an onchange method when
setting the employee), then the check_company mechanism will
raise an AccessError when trying the validate the companies on
the different records.

Specification
=============

As we only wish to validate the new record values and not the
access rights, the validation could be done as a superuser to
avoid unecessary errors.

closes odoo/odoo#43240

Taskid: 2170006
X-original-commit: 37a9b6c63dcbc268013fbe1a890cf9390eb8e223
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>

4 files changed, 45 insertions, 6 deletions

diff --git a/odoo/addons/test_new_api/models/test_new_api.py b/odoo/addons/test_new_api/models/test_new_api.py
index db227b1afbe..d88ab0777aa 100644
--- a/odoo/addons/test_new_api/models/test_new_api.py
+++ b/odoo/addons/test_new_api/models/test_new_api.py
@@ -710,6 +710,23 @@ class ModelChildNoCheck(models.Model):
     parent_id = fields.Many2one('test_new_api.model_parent', check_company=False)
 
 
+class ModelPrivateAddressOnchange(models.Model):
+    _name = 'test_new_api.model_private_address_onchange'
+    _description = 'Model Private Address Onchange'
+    _check_company_auto = True
+
+    name = fields.Char()
+    company_id = fields.Many2one('res.company', required=True)
+    address_id = fields.Many2one('res.partner', check_company=True)
+
+    @api.onchange('name')
+    def _onchange_name(self):
+        if self.name and not self.address_id:
+            self.address_id = self.env['res.partner'].sudo().create({
+                'name': self.name,
+                'type': 'private',
+            })
+
 # model with explicit and stored field 'display_name'
 class Display(models.Model):
     _name = 'test_new_api.display'
diff --git a/odoo/addons/test_new_api/security/ir.model.access.csv b/odoo/addons/test_new_api/security/ir.model.access.csv
index 1cefc74a26e..5a4f8ce3239 100644
--- a/odoo/addons/test_new_api/security/ir.model.access.csv
+++ b/odoo/addons/test_new_api/security/ir.model.access.csv
@@ -47,3 +47,4 @@ access_test_new_api_inverse_m2o_ref,access_test_new_api_inverse_m2o_ref,model_te
 access_test_new_api_model_binary,access_test_new_api_model_binary,model_test_new_api_model_binary,,1,1,1,1
 access_test_new_api_model_child_m2o,access_test_new_api_model_child_m2o,model_test_new_api_model_child_m2o,,1,1,1,1
 access_test_new_api_model_parent_m2o,access_test_new_api_model_parent_m2o,model_test_new_api_model_parent_m2o,,1,1,1,1
+access_test_new_api_model_private_address_onchange,access_test_new_api_model_private_address_onchange,model_test_new_api_model_private_address_onchange,base.group_user,1,1,1,1
diff --git a/odoo/addons/test_new_api/tests/test_company_checks.py b/odoo/addons/test_new_api/tests/test_company_checks.py
index 8d1aecaebfa..04b1df46846 100644
--- a/odoo/addons/test_new_api/tests/test_company_checks.py
+++ b/odoo/addons/test_new_api/tests/test_company_checks.py
@@ -173,3 +173,22 @@ class TestCompanyCheck(common.TransactionCase):
             comp_a_c_user.env.context['allowed_company_ids'],
             [self.company_a.id, self.company_c.id],
         )
+
+    def test_company_check_no_access(self):
+        """ Test that company_check validates correctly the companies on
+        the different records, even if the use has no access to one of the
+        records, example, a private address set by an onchange
+        """
+
+        user = self.env['res.users'].create({
+            'name': 'My Classic User',
+            'login': 'My Classic User',
+            'groups_id': [(6, 0, self.env.ref('base.group_user').ids)],
+        })
+
+        with common.Form(self.env['test_new_api.model_private_address_onchange'].with_user(user)) as form:
+            form.name = 'My Classic Name'
+            form.company_id = self.env.user.company_id
+            with self.assertRaises(AccessError):
+                form.address_id.name
+            form.save()
diff --git a/odoo/models.py b/odoo/models.py
index 3196fb5209e..5f9fa87346f 100644
--- a/odoo/models.py
+++ b/odoo/models.py
@@ -3164,12 +3164,13 @@ Fields:
             # The first part of the check verifies that all records linked via relation fields are compatible
             # with the company of the origin document, i.e. `self.account_id.company_id == self.company_id`
             for name in regular_fields:
+                corecord = record.sudo()[name]
                 # Special case with `res.users` since an user can belong to multiple companies.
-                if record[name]._name == 'res.users' and record[name].company_ids:
-                    if not (company <= record[name].company_ids):
+                if corecord._name == 'res.users' and corecord.company_ids:
+                    if not (company <= corecord.company_ids):
                         inconsistent_fields.add(name)
                         inconsistent_recs |= record
-                elif not (record[name].company_id <= company):
+                elif not (corecord.company_id <= company):
                     inconsistent_fields.add(name)
                     inconsistent_recs |= record
             # The second part of the check (for property / company-dependent fields) verifies that the records
@@ -3179,11 +3180,12 @@ Fields:
             company = self.env.company
             for name in property_fields:
                 # Special case with `res.users` since an user can belong to multiple companies.
-                if record[name]._name == 'res.users' and record[name].company_ids:
-                    if not (company <= record[name].company_ids):
+                corecord = record.sudo()[name]
+                if corecord._name == 'res.users' and corecord.company_ids:
+                    if not (company <= corecord.company_ids):
                         inconsistent_fields.add(name)
                         inconsistent_recs |= record
-                elif not (record[name].company_id <= company):
+                elif not (corecord.company_id <= company):
                     inconsistent_fields.add(name)
                     inconsistent_recs |= record