[IMP] stock: add company_id field on stock_move_line

There is no company_id field on stock.move.line and it is so impossible
to restrict easily the access rights on move lines (except by passing
through stock.move, but all stock move line don't always have a
stock.move)

To resolve this we've added a field company_id on stock.move.line, and a
constraint to force it having the same company_id than the one on stock
move.

Task ID : 1905232

closes odoo/odoo#28575

addons/stock/models/stock_move_line.py

@@ -22,6 +22,7 @@ class StockMoveLine(models.Model):
     move_id = fields.Many2one(
         'stock.move', 'Stock Move',
         help="Change to a better name", index=True)
+    company_id = fields.Many2one('res.company', string='Company', default=lambda self: self.env['res.users']._get_company(), readonly=True)
     product_id = fields.Many2one('product.product', 'Product', ondelete="cascade")
     product_uom_id = fields.Many2one('uom.uom', 'Unit of Measure', required=True)
     product_qty = fields.Float(
@@ -74,6 +75,12 @@ class StockMoveLine(models.Model):
             if line.lot_id and line.product_id != line.lot_id.product_id:
                 raise ValidationError(_('This lot %s is incompatible with this product %s' % (line.lot_id.name, line.product_id.display_name)))
 
+    @api.constrains('company_id', 'move_id')
+    def _check_same_company_id(self):
+        for line in self:
+            if line.move_id and line.move_id.company_id != line.company_id:
+                raise ValidationError(_('The move line a a different company than its move'))
+
     @api.one
     def _set_product_qty(self):
         """ The meaning of product_qty field changed lately and is now a functional field computing the quantity

addons/stock/security/stock_security.xml

@@ -97,6 +97,13 @@
         <field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
      </record>
 
+     <record model="ir.rule" id="stock_move_line_rule">
+        <field name="name">stock_move_line multi-company</field>
+        <field name="model_id" search="[('model','=','stock.move.line')]" model="ir.model"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('company_id','child_of',[user.company_id.id])]</field>
+     </record>
+
     <record model="ir.rule" id="stock_quant_rule">
         <field name="name">stock_quant multi-company</field>
         <field name="model_id" ref="model_stock_quant"/>