Document references endpoints are not respecting role permissions

[teosarca]

Is this a bug or feature request?

Bug

Which are the steps to reproduce?

e.g.

• open a completed sales order
• check document references. You shall see something like MRP Datensätze, along to other references
• go to role, disable the access to that window
• go back to sales order and check the references again
  ** the "MRP Datensätze" is still there => NOK
  ** when clicking on it a new window is opened with "No Access" error

What is the expected or desired behavior?

If user has no access to that window, don't show it in references.

[metas-lc]

IT

1. open a completed sales order
2. check document references.
   => there is MRP Datensätze, along to other references. Open it => window opens, no errors OK
3. go to role window, select the one you logged in with, go to window subtab and disable MRP Datensätze
4. go back to sales order, check document references
   => MRP Datensätze is not shown anymore OK
5. try to open MRP Datensätze with direct link => no access error OK
6. go to role and put MRP Datensätze back
7. check sales order => MRP Datensätze is shown OK