From 27d51c1f10e123fc0f840f53d9c29d5de030caa5 Mon Sep 17 00:00:00 2001
From: "Loukas Wets (lowe)" <lowe@odoo.com>
Date: Tue, 29 Aug 2023 10:59:17 +0000
Subject: [PATCH] [FIX] pos_self_order: acces without access token restriction

Following this PR https://github.com/odoo/odoo/pull/131140 when the self
order is accessed without access token the access restrictions are not
applied anymore. This commit aims to restore the previous behaviour
implemented in the following PR https://github.com/odoo/odoo/pull/122901/.

This commit also add a test to verify the flow of accessing the self order
without an access token. While doing so a the tour util cannotAddProduct
was fixed since it did not behave as inteded.

closes odoo/odoo#133595

X-original-commit: ae1dbc1d34fd622959540ec84bcefe795e15552b
Signed-off-by: Joseph Caburnay (jcb) <jcb@odoo.com>
Signed-off-by: Loukas Wets (lowe) <lowe@odoo.com>
---
 addons/pos_self_order/controllers/mobile_entry.py    |  4 +++-
 .../pages/product_main_view/product_main_view.xml    |  2 +-
 .../pos_self_order/static/tests/tours/tour_utils.js  | 12 +++++++++---
 addons/pos_self_order/tests/test_frontend.py         |  9 +++++++++
 4 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/addons/pos_self_order/controllers/mobile_entry.py b/addons/pos_self_order/controllers/mobile_entry.py
index d3940e662d7..5edf01cfc6f 100644
--- a/addons/pos_self_order/controllers/mobile_entry.py
+++ b/addons/pos_self_order/controllers/mobile_entry.py
@@ -31,6 +31,7 @@ class PosQRMenuController(http.Controller):
         auth="public", website=True, sitemap=True,
     )
     def pos_self_order_start(self, config_id=None, access_token=None, table_identifier=None):
+        self_order_mode = 'qr_code'
         pos_config_sudo = False
         table_sudo = False
         config_access_token = False
@@ -46,6 +47,7 @@ class PosQRMenuController(http.Controller):
                 raise werkzeug.exceptions.Unauthorized()
 
         if pos_config_sudo and pos_config_sudo.has_active_session and pos_config_sudo.self_order_table_mode:
+            self_order_mode = pos_config_sudo.self_order_pay_after
             table_sudo = table_identifier and (
                 request.env["restaurant.table"]
                 .sudo()
@@ -72,7 +74,7 @@ class PosQRMenuController(http.Controller):
                     **request.env["ir.http"].get_frontend_session_info(),
                     'currencies': request.env["ir.http"].get_currencies(),
                     'pos_self_order_data': {
-                        'self_order_mode': pos_config.self_order_pay_after,
+                        'self_order_mode': self_order_mode,
                         'table': table._get_self_order_data() if table else False,
                         'access_token': config_access_token,
                         **pos_config._get_self_order_mobile_data(),
diff --git a/addons/pos_self_order/static/src/mobile/pages/product_main_view/product_main_view.xml b/addons/pos_self_order/static/src/mobile/pages/product_main_view/product_main_view.xml
index 7a09dca7962..54a754de860 100644
--- a/addons/pos_self_order/static/src/mobile/pages/product_main_view/product_main_view.xml
+++ b/addons/pos_self_order/static/src/mobile/pages/product_main_view/product_main_view.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <templates id="template" xml:space="preserve">
     <t t-name="pos_self_order.ProductMainView">
-        <div class="d-flex flex-column dvh-100">
+        <div class="product_main_view d-flex flex-column dvh-100">
             <NavBar shadow="true" />
             <div class="bg-white d-flex flex-column pt-3 overflow-auto h-100">
                 <div class="px-3">
diff --git a/addons/pos_self_order/static/tests/tours/tour_utils.js b/addons/pos_self_order/static/tests/tours/tour_utils.js
index 393b6a643f8..06c918173ba 100644
--- a/addons/pos_self_order/static/tests/tours/tour_utils.js
+++ b/addons/pos_self_order/static/tests/tours/tour_utils.js
@@ -13,6 +13,7 @@
  * @property {string} name
  * @property {string} value
  */
+import { TourError } from "@web_tour/tour_service/tour_utils";
 
 export const PosSelf = {
     check: {
@@ -98,9 +99,14 @@ export const PosSelf = {
                     trigger: `.o_self_order_item_card .o_self_product_name:contains('${name}')`,
                 },
                 {
-                    content: `Click on 'Add' button`,
-                    trigger: `.btn:not(:contains('Add'))`,
-                    run: () => {},
+                    content: `Inside product main view 'Add' button should not be present`,
+                    trigger: `.product_main_view`,
+                    run: () => {
+                        const addButton = document.querySelector(".o_self_order_main_button");
+                        if (addButton){
+                            throw new TourError("Add button should not be present");
+                        }
+                    },
                 },
             ];
         },
diff --git a/addons/pos_self_order/tests/test_frontend.py b/addons/pos_self_order/tests/test_frontend.py
index e167eea55f9..8798a2149b9 100644
--- a/addons/pos_self_order/tests/test_frontend.py
+++ b/addons/pos_self_order/tests/test_frontend.py
@@ -30,3 +30,12 @@ class TestFrontendMobile(SelfOrderCommonTest):
             "self_order_after_meal_product_tour",
             login=None,
         )
+
+    def test_self_order_menu_only_accessing_without_token_tour(self):
+        self.pos_config.self_order_table_mode = True
+        self.pos_config.with_user(self.pos_user).open_ui()
+        self.start_tour(
+            f"/menu/{self.pos_config.id}",
+            "self_order_menu_only_tour",
+            login=None,
+        )