[FIX] sale_{purchase,stock}, stock: decreasing the ordered qty

In a MTO case, when a salesman decreases the ordered quantity, it can
lead to an access error

To reproduce the issue:
(Use demo data)
1. In Users, edit Marc Demo:
    - Invoicing: None
    - Purchase: None
2. Create a product P:
    - Type: Storable
    - Add a vendor V
    - Routes:
        - MTO
        - Buy
3. Log in as Marc Demo
4. Create a sale order SO with 2 x P
5. Confirm SO
6. Edit SO:
    - Set the qty of P to 1
    - ignore the warning
7. Save the SO

Error: There is an access error ("create" on "Activity" (mail.activity))

Because the user decreases the quantity, we want to log this decreasing
on the related documents:
https://github.com/odoo/odoo/blob/ee9ea35ad218be87564de484470f1c4e9c433977/addons/sale_stock/models/sale_order.py#L91-L94
In the above case, it leads to a write operation on the generated
purchase order. However, Marc Demo hasn't any right to perform such an
operation.

We should bypass the rights checking in such situation.

Note: in `/sale_stock:SaleOrder.write`: we need to specify what kind of
precision we are using.

OPW-2745317

closes odoo#90366

X-original-commit: 12f9691
Signed-off-by: William Henrotin (whe) <[email protected]>
Signed-off-by: Adrien Widart <[email protected]>

addons/sale_purchase_stock/tests/__init__.py

@@ -2,3 +2,4 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 from . import test_sale_purchase_stock_flow
+from . import test_access_rights

addons/sale_purchase_stock/tests/test_access_rights.py

@@ -0,0 +1,76 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo.tests import tagged
+from odoo.addons.sale_purchase.tests.common import TestCommonSalePurchaseNoChart
+
+
+@tagged('post_install', '-at_install')
+class TestAccessRights(TestCommonSalePurchaseNoChart):
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestAccessRights, cls).setUpClass()
+
+        group_sale_user = cls.env.ref('sales_team.group_sale_salesman')
+
+        cls.user_salesperson = cls.env['res.users'].with_context(no_reset_password=True).create({
+            'name': 'Le Grand Jojo User',
+            'login': 'grand.jojo',
+            'email': '[email protected]',
+            'groups_id': [(6, 0, [group_sale_user.id])]
+        })
+
+    def test_access_saleperson_decreases_qty(self):
+        """
+        Suppose a user who has no right on PO
+        Suppose a PO linked to a SO
+        The user decreases the qty on the SO
+        This test ensures that an activity (warning) is added to the PO
+        """
+        mto_route = self.env.ref('stock.route_warehouse0_mto')
+        buy_route = self.env.ref('purchase_stock.route_warehouse0_buy')
+        mto_route.active = True
+
+        vendor = self.env['res.partner'].create({'name': 'vendor'})
+        seller = self.env['product.supplierinfo'].create({
+            'name': vendor.id,
+            'price': 8,
+        })
+
+        product = self.env['product.product'].create({
+            'name': 'SuperProduct',
+            'type': 'product',
+            'seller_ids': [(6, 0, seller.ids)],
+            'route_ids': [(6, 0, (mto_route + buy_route).ids)]
+        })
+
+        so = self.env['sale.order'].with_user(self.user_salesperson).create({
+            'partner_id': self.partner_a.id,
+            'user_id': self.user_salesperson.id,
+        })
+        so_line, _ = self.env['sale.order.line'].create([{
+            'name': product.name,
+            'product_id': product.id,
+            'product_uom_qty': 1,
+            'product_uom': product.uom_id.id,
+            'price_unit': product.list_price,
+            'tax_id': False,
+            'order_id': so.id,
+        }, {
+            'name': 'Super Section',
+            'display_type': 'line_section',
+            'order_id': so.id,
+        }])
+
+        so.action_confirm()
+
+        po = self.env['purchase.order'].search([('partner_id', '=', vendor.id)])
+        po.button_confirm()
+
+        # salesperson writes on the SO
+        so.write({
+            'order_line': [(1, so_line.id, {'product_uom_qty': 0.9})]
+        })
+
+        self.assertIn(so.name, po.activity_ids.note)

addons/sale_stock/models/sale_order.py

@@ -117,13 +117,16 @@ def write(self, values):
 
         res = super(SaleOrder, self).write(values)
         if values.get('order_line') and self.state == 'sale':
+            rounding = self.env['decimal.precision'].precision_get('Product Unit of Measure')
             for order in self:
                 to_log = {}
                 for order_line in order.order_line:
-                    if float_compare(order_line.product_uom_qty, pre_order_line_qty.get(order_line, 0.0), order_line.product_uom.rounding) < 0:
+                    if order_line.display_type:
+                        continue
+                    if float_compare(order_line.product_uom_qty, pre_order_line_qty.get(order_line, 0.0), precision_rounding=order_line.product_uom.rounding or rounding) < 0:
                         to_log[order_line] = (order_line.product_uom_qty, pre_order_line_qty.get(order_line, 0.0))
                 if to_log:
-                    documents = self.env['stock.picking']._log_activity_get_documents(to_log, 'move_ids', 'UP')
+                    documents = self.env['stock.picking'].sudo()._log_activity_get_documents(to_log, 'move_ids', 'UP')
                     documents = {k:v for k, v in documents.items() if k[0].state != 'cancel'}
                     order._log_decrease_ordered_quantity(documents)
         return res