[FIX] account: allow users to see products after configuring taxes

The `account` module adds the `tax_string` field to product forms:
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/views/product_view.xml#L76

That field calls `Model(account.tax).compute_all()`:
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/product.py#L71

That method needs access to `account.account.tag` records:
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L563
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L632
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L648
https://github.com/odoo/odoo/blob/ceb8b785fba1055deeff8d9075ccc707f2317278/addons/account/models/account_tax.py#L671

Internal users were able to read `account.tax` and `account.tax.repartition.line` records, but they couldn't read `account.account.tag` records.

So, this lead to the absurd situation where a user with permissions to read products (like stock, PoS or event users) couldn't be able to see the product form anymore whenever that product happened to have a tax with a repartition line with a tag.

This is a regression from Odoo 14, introduced in odoo#74138 and odoo#73602.

I'm granting all internal users read permission over `account.account.tag`, just like the one they have for `account.tax` and `account.tax.repartition.line`. BTW that's the fix suggested by Odoo helpdesk.

Funny enough, while exercising the test, I also noticed that a similar situation happens with MRP. When installed, other users that would normally be able to browse products, would no longer have access. The fix is incouded too; otherwise the test wouldn't pass.

@moduon MT-4390
OPW-3636032

closes odoo#151639

X-original-commit: 9c7028b
Signed-off-by: Cedric Snauwaert <csn@odoo.com>

Author: yajo

addons/account/security/ir.model.access.csv

@@ -68,6 +68,7 @@ access_account_tax_internal_user,account.tax internal user,model_account_tax,bas
 access_account_tax_readonly,account.tax,model_account_tax,account.group_account_readonly,1,0,0,0
 access_account_tax_invoice,account.tax,model_account_tax,account.group_account_invoice,1,0,0,0
 access_account_tax_manager,account.tax,model_account_tax,account.group_account_manager,1,1,1,1
+access_account_tag_internal_user,account.account.tag internal user,model_account_account_tag,base.group_user,1,0,0,0
 access_account_account_tax,account.account.tag,model_account_account_tag,account.group_account_user,1,1,1,1
 access_account_account_tax_readonly,account.account.tag,model_account_account_tag,account.group_account_readonly,1,0,0,0
 access_account_account_tax_user,account.account.tag,model_account_account_tag,account.group_account_invoice,1,0,0,0

addons/account/tests/__init__.py

@@ -29,6 +29,7 @@
 from . import test_account_move_send
 from . import test_account_all_l10n
 from . import test_portal_attachment
+from . import test_product
 from . import test_tax_report
 from . import test_transfer_wizard
 from . import test_account_incoming_supplier_invoice

addons/account/tests/test_product.py

@@ -0,0 +1,37 @@
+from .common import AccountTestInvoicingCommon
+from odoo.tests.common import Form, tagged, new_test_user
+from odoo import Command
+
+
+@tagged("post_install", "-at_install")
+class AccountProductCase(AccountTestInvoicingCommon):
+    @classmethod
+    def setUpClass(cls, chart_template_ref=None):
+        super().setUpClass(chart_template_ref)
+        cls.internal_user = new_test_user(
+            cls.env, login="internal_user", groups="base.group_user"
+        )
+
+    def test_internal_user_can_read_product_with_tax_and_tags(self):
+        """Internal users need read access to products, no matter their taxes."""
+        # Add a tag to product_a's default tax
+        self.company_data["company"].country_id = self.env.ref("base.us")
+        tax_line_tag = self.env["account.account.tag"].create(
+            {
+                "name": "Tax tag",
+                "applicability": "taxes",
+                "country_id": self.company_data["company"].country_id.id,
+            }
+        )
+        repartition_lines = (
+            self.product_a.taxes_id.invoice_repartition_line_ids
+            | self.product_a.taxes_id.refund_repartition_line_ids
+        ).filtered_domain([("repartition_type", "=", "tax")])
+        repartition_lines.write({"tag_ids": [Command.link(tax_line_tag.id)]})
+        # Check that internal user can read product_a
+        with Form(
+            self.product_a.with_user(self.internal_user).with_context(lang="en_US")
+        ) as form_a:
+            # The tax string itself is not very important here; we just check
+            # it has a value and we can read it, so there were no access errors
+            self.assertTrue(form_a.tax_string)

addons/mrp/models/product.py

@@ -30,7 +30,7 @@ class ProductTemplate(models.Model):
         compute='_compute_used_in_bom_count', compute_sudo=False)
     mrp_product_qty = fields.Float('Manufactured', digits='Product Unit of Measure',
         compute='_compute_mrp_product_qty', compute_sudo=False)
-    is_kits = fields.Boolean(compute='_compute_is_kits', compute_sudo=False)
+    is_kits = fields.Boolean(compute='_compute_is_kits', compute_sudo=True)
 
     def _compute_bom_count(self):
         for product in self:
@@ -109,7 +109,7 @@ class ProductProduct(models.Model):
         compute='_compute_used_in_bom_count', compute_sudo=False)
     mrp_product_qty = fields.Float('Manufactured', digits='Product Unit of Measure',
         compute='_compute_mrp_product_qty', compute_sudo=False)
-    is_kits = fields.Boolean(compute="_compute_is_kits", compute_sudo=False)
+    is_kits = fields.Boolean(compute="_compute_is_kits", compute_sudo=True)
 
     def _compute_bom_count(self):
         for product in self: