[FIX] account: allow users to see products after configuring taxes

The `account` module adds the `tax_string` field to product forms:
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/views/product_view.xml#L76

That field calls `Model(account.tax).compute_all()`:
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/product.py#L71

That method needs access to `account.account.tag` records:
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L563
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L632
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L648
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L671

Internal users were able to read `account.tax` and `account.tax.repartition.line` records, but they couldn't read `account.account.tag` records.

So, this lead to the absurd situation where a user with permissions to read products (like stock, PoS or event users) couldn't be able to see the product form anymore whenever that product happened to have a tax with a repartition line with a tag.

This is a regression from Odoo 14, introduced in odoo#74138 and odoo#73602.

I'm granting all internal users read permission over `account.account.tag`, just like the one they have for `account.tax` and `account.tax.repartition.line`. BTW that's the fix suggested by Odoo helpdesk.

@moduon MT-4390
OPW-3636032

X-original-commit: 5fb4e82

Author: yajo

addons/account/security/ir.model.access.csv

@@ -70,6 +70,7 @@ access_account_tax_internal_user,account.tax internal user,model_account_tax,bas
 access_account_tax_readonly,account.tax,model_account_tax,account.group_account_readonly,1,0,0,0
 access_account_tax_invoice,account.tax,model_account_tax,account.group_account_invoice,1,0,0,0
 access_account_tax_manager,account.tax,model_account_tax,account.group_account_manager,1,1,1,1
+access_account_tag_internal_user,account.account.tag internal user,model_account_account_tag,base.group_user,1,0,0,0
 access_account_account_tax,account.account.tag,model_account_account_tag,account.group_account_user,1,1,1,1
 access_account_account_tax_readonly,account.account.tag,model_account_account_tag,account.group_account_readonly,1,0,0,0
 access_account_account_tax_user,account.account.tag,model_account_account_tag,account.group_account_invoice,1,0,0,0

addons/account/tests/test_product.py

@@ -1,12 +1,37 @@
 # -*- coding: utf-8 -*-
 
 from odoo.addons.account.tests.common import AccountTestInvoicingCommon
-from odoo.tests import tagged
+from odoo.tests import Form, tagged
+from odoo.tests.common import new_test_user
 
 
 @tagged('post_install', 'post_install_l10n', '-at_install')
 class TestProduct(AccountTestInvoicingCommon):
 
+    @classmethod
+    def setUpClass(cls, chart_template_ref=None):
+        super().setUpClass(chart_template_ref)
+        cls.internal_user = new_test_user(
+            cls.env,
+            login="internal_user",
+            groups="base.group_user",
+        )
+
+    def test_internal_user_can_read_product_with_tax_and_tags(self):
+        """Internal users need read access to products, no matter their taxes."""
+        # Add a tag to product_a's default tax
+        tax_line_tag = self.env["account.account.tag"].create({
+            "name": "Tax tag",
+            "applicability": "taxes",
+        })
+        self.product_a.taxes_id.repartition_line_ids.tag_ids = tax_line_tag
+        # Check that internal user can read product_a
+        self.env.invalidate_all()
+        with Form(self.product_a.with_user(self.internal_user)) as form_a:
+            # The tax string itself is not very important here; we just check
+            # it has a value and we can read it, so there were no access errors
+            self.assertTrue(form_a.tax_string)
+
     def test_multi_company_product_tax(self):
         """ Ensure default taxes are set for all companies on products with no company set. """
         product_without_company = self.env['product.template'].with_context(allowed_company_ids=self.env.company.ids).create({